emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

unlzma: fix another SEGV case

Browse Source 
function                                             old     new   delta
unpack_lzma_stream                                  1705    1717     +12

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2018-04-19 19:29:49 +02:00
parent 2aeb201c97
commit e09c426456
3 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
archival/libarchive/decompress_unlzma.c
View File

@ -224,6 +224,7 @@ unpack_lzma_stream(transformer_state_t *xstate)
rc_t *rc; rc_t *rc;
int i; int i;
uint8_t *buffer; uint8_t *buffer;
uint32_t buffer_size;
uint8_t previous_byte = 0; uint8_t previous_byte = 0;
size_t buffer_pos = 0, global_pos = 0; size_t buffer_pos = 0, global_pos = 0;
int len = 0; int len = 0;
@ -253,7 +254,8 @@ unpack_lzma_stream(transformer_state_t *xstate)
if (header.dict_size == 0) if (header.dict_size == 0)
header.dict_size++; header.dict_size++;
buffer = xmalloc(MIN(header.dst_size, header.dict_size)); buffer_size = MIN(header.dst_size, header.dict_size);
buffer = xmalloc(buffer_size);
{ {
int num_probs; int num_probs;
@ -464,7 +466,10 @@ unpack_lzma_stream(transformer_state_t *xstate)
if ((int32_t)pos < 0) { if ((int32_t)pos < 0) {
pos += header.dict_size; pos += header.dict_size;
/* bug 10436 has an example file where this triggers: */ /* bug 10436 has an example file where this triggers: */
if ((int32_t)pos < 0) //if ((int32_t)pos < 0)
// goto bad;
/* more stringent test (see unzip_bad_lzma_1.zip): */
if (pos >= buffer_size)
goto bad; goto bad;
} }
previous_byte = buffer[pos]; previous_byte = buffer[pos];

15
testsuite/unzip.tests
View File

@ -14,7 +14,7 @@
# Create a scratch directory # Create a scratch directory
mkdir temp mkdir temp
cd temp cd temp || exit 90
# Create test file to work with. # Create test file to work with.
@ -52,7 +52,18 @@ NzITNFBLBQUKAC4JAA04Cw0EOhZQSwUGAQAABAIAAgCZAAAAeQAAAAIALhM=
" "
SKIP= SKIP=
rm * rm -f *
optional CONFIG_FEATURE_UNZIP_LZMA
testing "unzip (archive with corrupted lzma)" "unzip -p ../unzip_bad_lzma_1.zip 2>&1; echo \$?" \
"unzip: removing leading '/' from member names
unzip: inflate error
1
" \
"" ""
SKIP=
rm -f *
# Clean up scratch directory. # Clean up scratch directory.

BIN
testsuite/unzip_bad_lzma_1.zip Normal file
View File

Binary file not shown.