[ipfire-2.x.git] / src / patches / p7zip / CVE-2016-2335.patch

Index: p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
===================================================================
--- p7zip_15.14.1.orig/CPP/7zip/Archive/Udf/UdfIn.cpp
+++ p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
@@ -389,7 +389,11 @@ HRESULT CInArchive::ReadFileItem(int vol
     return S_FALSE;
   CFile &file = Files.Back();
   const CLogVol &vol = LogVols[volIndex];
-  CPartition &partition = Partitions[vol.PartitionMaps[lad.Location.PartitionRef].PartitionIndex];
+  unsigned partitionRef = lad.Location.PartitionRef;
+
+  if (partitionRef >= vol.PartitionMaps.Size())
+  	return S_FALSE;
+  CPartition &partition = Partitions[vol.PartitionMaps[partitionRef].PartitionIndex];
 
   UInt32 key = lad.Location.Pos;
   UInt32 value;
Commit	Line	Data
afc14499 AF	1	Index: p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
	2	===================================================================
	3	--- p7zip_15.14.1.orig/CPP/7zip/Archive/Udf/UdfIn.cpp
	4	+++ p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
	5	@@ -389,7 +389,11 @@ HRESULT CInArchive::ReadFileItem(int vol
	6	return S_FALSE;
	7	CFile &file = Files.Back();
	8	const CLogVol &vol = LogVols[volIndex];
	9	- CPartition &partition = Partitions[vol.PartitionMaps[lad.Location.PartitionRef].PartitionIndex];
	10	+ unsigned partitionRef = lad.Location.PartitionRef;
	11	+
	12	+ if (partitionRef >= vol.PartitionMaps.Size())
	13	+ return S_FALSE;
	14	+ CPartition &partition = Partitions[vol.PartitionMaps[partitionRef].PartitionIndex];
	15
	16	UInt32 key = lad.Location.Pos;
	17	UInt32 value;