xar: Fix another infinite loop and expat error handling (#2150)

Fixes two issues:
- expat code keeps track of error conditions
- adding link=original multiple times is prohibited

diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c
index 2c3432642937bcfbae209aad48c913ec68f32558..cefb36410e77c5981949b0015fd25d41573f8f66 100644 (file)
--- a/libarchive/archive_read_support_format_xar.c
+++ b/libarchive/archive_read_support_format_xar.c
@@ -2055,9 +2055,10 @@ xml_start(struct archive_read *a, const char *name, struct xmlattr_list *list)
                            attr = attr->next) {
                                if (strcmp(attr->name, "link") != 0)
                                        continue;
-                               if (xar->file->hdnext != NULL || xar->file->link != 0) {
+                               if (xar->file->hdnext != NULL || xar->file->link != 0 ||
+                                   xar->file == xar->hdlink_orgs) {
                                        archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
-                                           "File with multiple link targets");
+                                           "File with multiple link attributes");
                                        return (ARCHIVE_FATAL);
                                }
                                if (strcmp(attr->value, "original") == 0) {
@@ -3256,6 +3257,9 @@ expat_start_cb(void *userData, const XML_Char *name, const XML_Char **atts)
        struct xmlattr_list list;
        int r;
 
+       if (ud->state != ARCHIVE_OK)
+               return;
+
        r = expat_xmlattr_setup(a, &list, atts);
        if (r == ARCHIVE_OK)
                r = xml_start(a, (const char *)name, &list);

diff --git a/libarchive/test/test_read_format_xar_doublelink.c b/libarchive/test/test_read_format_xar_doublelink.c
index 73ddebd285b92a78155e5e8e48b6ee660347bd32..78d6626a09bfb6b70ae7cf1136d4276bddf32a3e 100644 (file)
--- a/libarchive/test/test_read_format_xar_doublelink.c
+++ b/libarchive/test/test_read_format_xar_doublelink.c
@@ -47,7 +47,7 @@ DEFINE_TEST(test_read_format_xar_doublelink)
 
        assertA(ARCHIVE_FATAL == archive_read_next_header(a, &ae));
        assertEqualString(archive_error_string(a),
-               "File with multiple link targets");
+               "File with multiple link attributes");
        assert(archive_errno(a) != 0);
 
        assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));