Check size of the extended time field in zip archives

Reported-By: OSS-Fuzz issue 4969

diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
index 784160070ddebbdfd0d0f62b23d61bd2f9d02ea5..18f0d04e5c4e3d9617f3d6d7b569b596327b4136 100644 (file)
--- a/libarchive/archive_read_support_format_zip.c
+++ b/libarchive/archive_read_support_format_zip.c
@@ -511,7 +511,13 @@ process_extra(struct archive_read *a, const char *p, size_t extra_length, struct
                case 0x5455:
                {
                        /* Extended time field "UT". */
-                       int flags = p[offset];
+                       int flags;
+                       if (datasize == 0) {
+                               archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+                                   "Incomplete extended time field");
+                               return ARCHIVE_FAILED;
+                       }
+                       flags = p[offset];
                        offset++;
                        datasize--;
                        /* Flag bits indicate which dates are present. */