Do not read beyond strtab table size in _ar_read_header()

Reported-by:	OSS-Fuzz issue 237

diff --git a/libarchive/archive_read_support_format_ar.c b/libarchive/archive_read_support_format_ar.c
index ff81f5fb770a82de2c741f28cad76e04bd2adf24..b6b9fc3c6dcd12941ecce982065262f8bee660b0 100644 (file)
--- a/libarchive/archive_read_support_format_ar.c
+++ b/libarchive/archive_read_support_format_ar.c
@@ -315,7 +315,7 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
                 * If we can't look up the real name, warn and return
                 * the entry with the wrong name.
                 */
-               if (ar->strtab == NULL || number > ar->strtab_size) {
+               if (ar->strtab == NULL || number >= ar->strtab_size) {
                        archive_set_error(&a->archive, EINVAL,
                            "Can't find long filename for GNU/SVR4 archive entry");
                        archive_entry_copy_pathname(entry, filename);