repo_arch: limit the package entry size

diff --git a/ext/repo_arch.c b/ext/repo_arch.c
index 4221b058a05876eaa1a931189c08e7b3592c546f..1bea691cbcd471a23f0a09034f16ca9ab50d4976 100644 (file)
--- a/ext/repo_arch.c
+++ b/ext/repo_arch.c
@@ -23,6 +23,8 @@
 #include "tarhead.h"
 #include "repo_arch.h"
 
+#define MAX_ENTRY_SIZE        0x1000000
+
 static Offset
 adddep(Repo *repo, Offset olddeps, char *line)
 {
@@ -98,7 +100,7 @@ repo_add_arch_pkg(Repo *repo, const char *fn, int flags)
   tarhead_init(&th, fp);
   while (tarhead_next(&th) > 0)
     {
-      if (th.type != 1 || strcmp(th.path, ".PKGINFO") != 0)
+      if (th.type != 1 || strcmp(th.path, ".PKGINFO") != 0 || th.length > MAX_ENTRY_SIZE)
        {
           tarhead_skip(&th);
          continue;
@@ -467,7 +469,7 @@ repo_add_arch_repo(Repo *repo, FILE *fp, int flags)
   while (tarhead_next(&th) > 0)
     {
       char *bn;
-      if (th.type != 1)
+      if (th.type != 1 || th.length > MAX_ENTRY_SIZE)
        {
           tarhead_skip(&th);
          continue;