From: Tim Kientzle <kientzle@acm.org>
Date: Thu, 24 Mar 2022 09:35:00 +0000 (+0100)
Subject: ZIP reader: fix possible out-of-bounds read in zipx_lzma_alone_init()
X-Git-Tag: v3.6.1~5
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cfaa28168a07ea4a53276b63068f94fce37d6aff;p=thirdparty%2Flibarchive.git

ZIP reader: fix possible out-of-bounds read in zipx_lzma_alone_init()

Fixes #1672
---

diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
index 38ada70b5..9d6c900b2 100644
--- a/libarchive/archive_read_support_format_zip.c
+++ b/libarchive/archive_read_support_format_zip.c
@@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zip *zip)
 	 */
 
 	/* Read magic1,magic2,lzma_params from the ZIPX stream. */
-	if((p = __archive_read_ahead(a, 9, NULL)) == NULL) {
+	if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) {
 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 		    "Truncated lzma data");
 		return (ARCHIVE_FATAL);