]> git.ipfire.org Git - thirdparty/libarchive.git/commit
Avoid overflow when reading corrupt cpio archive 929/head
authorColin Percival <cperciva@tarsnap.com>
Fri, 28 Jul 2017 23:28:50 +0000 (16:28 -0700)
committerColin Percival <cperciva@tarsnap.com>
Thu, 3 Aug 2017 03:39:05 +0000 (20:39 -0700)
commit7947883be19ad55a41de7d26671660817dca9ece
tree1d9b738e7848973fc3da36aa167edb2d73b7f683
parentde20494ba2a4fcff8b56010faa75467ad8d5a40b
Avoid overflow when reading corrupt cpio archive

A cpio "newc" archive with a namelength of "FFFFFFFF", if read on a
system with a 32-bit size_t, would result in namelength + name_pad
overflowing 32 bits and libarchive attempting to copy 2^32-1 bytes
from a 2-byte buffer, with appropriately hilarious results.

Check for this overflow and fail; there's no legitimate reason for a
cpio archive to contain a file with a name over 4 billion characters
in length.

Reported by: Eyal Itkin
Security: Corrupt archives can cause libarchive to crash on
32-bit platforms.
Sponsored by: Tarsnap Backup Inc.
libarchive/archive_read_support_format_cpio.c