Make sure the return value of get_path_component() is valid.

SVN-Revision: 2328

diff --git a/libarchive/archive_write_set_format_iso9660.c b/libarchive/archive_write_set_format_iso9660.c
index 410416b1cae58e57179cbb1fe03c26aaac2c1bdb..77ebd1df0a90a754a347e1b9addbfed9dc8906b9 100644 (file)
--- a/libarchive/archive_write_set_format_iso9660.c
+++ b/libarchive/archive_write_set_format_iso9660.c
@@ -5388,6 +5388,18 @@ isoent_tree(struct archive_write *a, struct isoent *isoent)
 
        for (;;) {
                l = get_path_component(name, sizeof(name), fn);
+               if (l == 0) {
+                       np = NULL;
+                       break;
+               }
+               if (l < 0) {
+                       archive_set_error(&a->archive,
+                           ARCHIVE_ERRNO_MISC,
+                           "A name buffer is too small");
+                       _isoent_free(isoent);
+                       return (NULL);
+               }
+
                np = isoent_find_child(dent, name);
                if (np == NULL || fn[0] == '\0')
                        break;
@@ -5441,6 +5453,14 @@ isoent_tree(struct archive_write *a, struct isoent *isoent)
                        if (fn[0] == '/')
                                fn++;
                        l = get_path_component(name, sizeof(name), fn);
+                       if (l < 0) {
+                               archive_string_free(&as);
+                               archive_set_error(&a->archive,
+                                   ARCHIVE_ERRNO_MISC,
+                                   "A name buffer is too small");
+                               _isoent_free(isoent);
+                               return (NULL);
+                       }
                        dent = np;
                }