Allow 128K -1 bytes of extra data before uuencode data starts since the bidder allows.

SVN-Revision: 3508

diff --git a/libarchive/archive_read_support_filter_uu.c b/libarchive/archive_read_support_filter_uu.c
index 56fb6623d17474e4bc60b3376cd771cc20e87d46..c30969153ce74798a92fb7a16c5c486c246a55d0 100644 (file)
--- a/libarchive/archive_read_support_filter_uu.c
+++ b/libarchive/archive_read_support_filter_uu.c
@@ -518,11 +518,16 @@ read_more:
                        }
                        break;
                }
-               if (total + len * 2 > OUT_BUFF_SIZE)
-                       break;
                switch (uudecode->state) {
                default:
                case ST_FIND_HEAD:
+                       /* Do not read more than UUENCODE_BID_MAX_READ bytes */
+                       if (total + len >= UUENCODE_BID_MAX_READ) {
+                               archive_set_error(&self->archive->archive,
+                                   ARCHIVE_ERRNO_FILE_FORMAT,
+                                   "Invalid format data");
+                               return (ARCHIVE_FATAL);
+                       }
                        if (len - nl > 13 && memcmp(b, "begin ", 6) == 0)
                                l = 6;
                        else if (len - nl > 18 &&
@@ -540,6 +545,8 @@ read_more:
                        }
                        break;
                case ST_READ_UU:
+                       if (total + len * 2 > OUT_BUFF_SIZE)
+                               break;
                        body = len - nl;
                        if (!uuchar[*b] || body <= 0) {
                                archive_set_error(&self->archive->archive,
@@ -604,6 +611,8 @@ read_more:
                        }
                        break;
                case ST_READ_BASE64:
+                       if (total + len * 2 > OUT_BUFF_SIZE)
+                               break;
                        l = len - nl;
                        if (l >= 3 && b[0] == '=' && b[1] == '=' &&
                            b[2] == '=') {

diff --git a/libarchive/test/test_read_uu.c b/libarchive/test/test_read_uu.c
index 3751f360faa21bb13762c4ca6883ed558acd7f3b..f4169e3256d24a874ab479d4473ea4ca84aca91c 100644 (file)
--- a/libarchive/test/test_read_uu.c
+++ b/libarchive/test/test_read_uu.c
@@ -123,27 +123,18 @@ test_read_uu_sub(const char *uudata, size_t uusize, int no_nl)
                    archive_read_support_format_all(a));
                assertEqualIntA(a, ARCHIVE_OK,
                    read_open_memory(a, buff, size, 2));
-               if (extra == 64 && no_nl) {
-                       /* TODO : Should we not recognize uuencoded data at
-                        * bidding data type in this case ? */
-                       failure("64K bytes extra data without NL "
-                           "should not decode uuencoded data");
-                       assertEqualIntA(a, ARCHIVE_EOF,
-                           archive_read_next_header(a, &ae));
-               } else {
-                       assertEqualIntA(a, ARCHIVE_OK,
-                           archive_read_next_header(a, &ae));
-                       failure("archive_compression_name(a)=\"%s\""
-                           "extra %d, NL %d",
-                           archive_compression_name(a), extra, !no_nl);
-                       assertEqualInt(archive_compression(a),
-                           ARCHIVE_COMPRESSION_COMPRESS);
-                       failure("archive_format_name(a)=\"%s\""
-                           "extra %d, NL %d",
-                           archive_format_name(a), extra, !no_nl);
-                       assertEqualInt(archive_format(a),
-                           ARCHIVE_FORMAT_TAR_USTAR);
-               }
+               assertEqualIntA(a, ARCHIVE_OK,
+                   archive_read_next_header(a, &ae));
+               failure("archive_compression_name(a)=\"%s\""
+                   "extra %d, NL %d",
+                   archive_compression_name(a), extra, !no_nl);
+               assertEqualInt(archive_compression(a),
+                   ARCHIVE_COMPRESSION_COMPRESS);
+               failure("archive_format_name(a)=\"%s\""
+                   "extra %d, NL %d",
+                   archive_format_name(a), extra, !no_nl);
+               assertEqualInt(archive_format(a),
+                   ARCHIVE_FORMAT_TAR_USTAR);
                assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
                assertEqualInt(ARCHIVE_OK, archive_read_free(a));
        }
@@ -151,7 +142,7 @@ test_read_uu_sub(const char *uudata, size_t uusize, int no_nl)
        /* UUdecode bidder shouldn't scan too much data; make sure it
         * fails if we put 512k of data before the start. */
        size = 512 * 1024;
-       for (extra = 0; extra < size; ++extra)
+       for (extra = 0; (size_t)extra < size; ++extra)
                buff[extra + 1024] = buff[extra];
        buff[size - 1] = '\n';
        memcpy(buff + size, uudata, uusize);