git: 8342c11f27eb - stable/11 - libarchive: merge vendor bugfix
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 23 Feb 2022 12:36:09 UTC
The branch stable/11 has been updated by mm: URL: https://cgit.FreeBSD.org/src/commit/?id=8342c11f27ebf504e25a00daad3351e1a508a774 commit 8342c11f27ebf504e25a00daad3351e1a508a774 Author: Martin Matuska <mm@FreeBSD.org> AuthorDate: 2022-02-21 11:06:54 +0000 Commit: Martin Matuska <mm@FreeBSD.org> CommitDate: 2022-02-23 11:37:34 +0000 libarchive: merge vendor bugfix OSS-Fuzz #44843 (security): RAR reader: fix null-dereference in RAR (v4) filter code (cherry picked from commit 5ccf909af9c1117172ff0742515da2d2e0cef89e) --- .../libarchive/libarchive/archive_read_support_format_rar.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/contrib/libarchive/libarchive/archive_read_support_format_rar.c b/contrib/libarchive/libarchive/archive_read_support_format_rar.c index 388484a76809..7a7318522650 100644 --- a/contrib/libarchive/libarchive/archive_read_support_format_rar.c +++ b/contrib/libarchive/libarchive/archive_read_support_format_rar.c @@ -3328,20 +3328,25 @@ run_filters(struct archive_read *a) struct rar *rar = (struct rar *)(a->format->data); struct rar_filters *filters = &rar->filters; struct rar_filter *filter = filters->stack; - size_t start = filters->filterstart; - size_t end = start + filter->blocklength; + size_t start, end; int64_t tend; uint32_t lastfilteraddress; uint32_t lastfilterlength; int ret; + if (filters == NULL || filter == NULL) + return (0); + + start = filters->filterstart; + end = start + filter->blocklength; + filters->filterstart = INT64_MAX; tend = (int64_t)end; ret = expand(a, &tend); if (ret != ARCHIVE_OK) - return (ret); + return 0; if (tend < 0) - return (ARCHIVE_FATAL); + return 0; end = (size_t)tend; if (end != start + filter->blocklength) return 0;