XAR reader: initialize file_queue with 0 and memcpy() if allocated only

Fixes #1338

diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c
index 7f8be398c7a2643960ab6a0cb4838567db0176b2..503ff58b91db5d783b7c9a664e5c2fe7c51c4899 100644 (file)
--- a/libarchive/archive_read_support_format_xar.c
+++ b/libarchive/archive_read_support_format_xar.c
@@ -458,6 +458,11 @@ archive_read_support_format_xar(struct archive *_a)
                return (ARCHIVE_FATAL);
        }
 
+       /* initialize xar->file_queue */
+       xar->file_queue.allocated = 0;
+       xar->file_queue.used = 0;
+       xar->file_queue.files = NULL;
+
        r = __archive_read_register_format(a,
            xar,
            "xar",
@@ -1221,10 +1226,12 @@ heap_add_entry(struct archive_read *a,
        /* Expand our pending files list as necessary. */
        if (heap->used >= heap->allocated) {
                struct xar_file **new_pending_files;
-               int new_size = heap->allocated * 2;
+               int new_size;
 
                if (heap->allocated < 1024)
                        new_size = 1024;
+               else
+                       new_size = heap->allocated * 2;
                /* Overflow might keep us from growing the list. */
                if (new_size <= heap->allocated) {
                        archive_set_error(&a->archive,
@@ -1238,9 +1245,11 @@ heap_add_entry(struct archive_read *a,
                            ENOMEM, "Out of memory");
                        return (ARCHIVE_FATAL);
                }
-               memcpy(new_pending_files, heap->files,
-                   heap->allocated * sizeof(new_pending_files[0]));
-               free(heap->files);
+               if (heap->allocated) {
+                       memcpy(new_pending_files, heap->files,
+                           heap->allocated * sizeof(new_pending_files[0]));
+                       free(heap->files);
+               }
                heap->files = new_pending_files;
                heap->allocated = new_size;
        }