Sanity check to a copy length of decoded data in order not to cause

a segmentation fault when reading a broken RAR file.

SVN-Revision: 3564

diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index c34f1289143df29dca9755cc84c75d837f1e54ea..974c881db5838163f9399e3185e131741e9505ff 100644 (file)
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -2218,6 +2218,11 @@ copy_from_lzss_window(struct archive_read *a, const void **buffer,
   else
   {
     firstpart = lzss_size(&rar->lzss) - windowoffs;
+    if (firstpart < 0) {
+      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+                        "Bad RAR file data");
+      return (ARCHIVE_FAILED);
+    }
     memcpy(&rar->unp_buffer[0], &rar->lzss.window[windowoffs], firstpart);
     memcpy(&rar->unp_buffer[firstpart], &rar->lzss.window[0],
            length - firstpart);