From: Michihiro NAKAJIMA <ggcueroad@gmail.com>
Date: Thu, 28 Jul 2011 04:16:37 +0000 (-0400)
Subject: Allow 128K -1 bytes of extra data before uuencode data starts since the bidder allows.
X-Git-Tag: v3.0.0a~223
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=42ecca9d45b0e170e9c3e88e5c2b45f6d4b4702d;p=thirdparty%2Flibarchive.git

Allow 128K -1 bytes of extra data before uuencode data starts since the bidder allows.

SVN-Revision: 3508
---

diff --git a/libarchive/archive_read_support_filter_uu.c b/libarchive/archive_read_support_filter_uu.c
index 56fb6623d..c30969153 100644
--- a/libarchive/archive_read_support_filter_uu.c
+++ b/libarchive/archive_read_support_filter_uu.c
@@ -518,11 +518,16 @@ read_more:
 			}
 			break;
 		}
-		if (total + len * 2 > OUT_BUFF_SIZE)
-			break;
 		switch (uudecode->state) {
 		default:
 		case ST_FIND_HEAD:
+			/* Do not read more than UUENCODE_BID_MAX_READ bytes */
+			if (total + len >= UUENCODE_BID_MAX_READ) {
+				archive_set_error(&self->archive->archive,
+				    ARCHIVE_ERRNO_FILE_FORMAT,
+				    "Invalid format data");
+				return (ARCHIVE_FATAL);
+			}
 			if (len - nl > 13 && memcmp(b, "begin ", 6) == 0)
 				l = 6;
 			else if (len - nl > 18 &&
@@ -540,6 +545,8 @@ read_more:
 			}
 			break;
 		case ST_READ_UU:
+			if (total + len * 2 > OUT_BUFF_SIZE)
+				break;
 			body = len - nl;
 			if (!uuchar[*b] || body <= 0) {
 				archive_set_error(&self->archive->archive,
@@ -604,6 +611,8 @@ read_more:
 			}
 			break;
 		case ST_READ_BASE64:
+			if (total + len * 2 > OUT_BUFF_SIZE)
+				break;
 			l = len - nl;
 			if (l >= 3 && b[0] == '=' && b[1] == '=' &&
 			    b[2] == '=') {
diff --git a/libarchive/test/test_read_uu.c b/libarchive/test/test_read_uu.c
index 3751f360f..f4169e325 100644
--- a/libarchive/test/test_read_uu.c
+++ b/libarchive/test/test_read_uu.c
@@ -123,27 +123,18 @@ test_read_uu_sub(const char *uudata, size_t uusize, int no_nl)
 		    archive_read_support_format_all(a));
 		assertEqualIntA(a, ARCHIVE_OK,
 		    read_open_memory(a, buff, size, 2));
-		if (extra == 64 && no_nl) {
-			/* TODO : Should we not recognize uuencoded data at
-			 * bidding data type in this case ? */
-			failure("64K bytes extra data without NL "
-			    "should not decode uuencoded data");
-			assertEqualIntA(a, ARCHIVE_EOF,
-			    archive_read_next_header(a, &ae));
-		} else {
-			assertEqualIntA(a, ARCHIVE_OK,
-			    archive_read_next_header(a, &ae));
-			failure("archive_compression_name(a)=\"%s\""
-			    "extra %d, NL %d",
-			    archive_compression_name(a), extra, !no_nl);
-			assertEqualInt(archive_compression(a),
-			    ARCHIVE_COMPRESSION_COMPRESS);
-			failure("archive_format_name(a)=\"%s\""
-			    "extra %d, NL %d",
-			    archive_format_name(a), extra, !no_nl);
-			assertEqualInt(archive_format(a),
-			    ARCHIVE_FORMAT_TAR_USTAR);
-		}
+		assertEqualIntA(a, ARCHIVE_OK,
+		    archive_read_next_header(a, &ae));
+		failure("archive_compression_name(a)=\"%s\""
+		    "extra %d, NL %d",
+		    archive_compression_name(a), extra, !no_nl);
+		assertEqualInt(archive_compression(a),
+		    ARCHIVE_COMPRESSION_COMPRESS);
+		failure("archive_format_name(a)=\"%s\""
+		    "extra %d, NL %d",
+		    archive_format_name(a), extra, !no_nl);
+		assertEqualInt(archive_format(a),
+		    ARCHIVE_FORMAT_TAR_USTAR);
 		assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
 		assertEqualInt(ARCHIVE_OK, archive_read_free(a));
 	}
@@ -151,7 +142,7 @@ test_read_uu_sub(const char *uudata, size_t uusize, int no_nl)
 	/* UUdecode bidder shouldn't scan too much data; make sure it
 	 * fails if we put 512k of data before the start. */
 	size = 512 * 1024;
-	for (extra = 0; extra < size; ++extra)
+	for (extra = 0; (size_t)extra < size; ++extra)
 		buff[extra + 1024] = buff[extra];
 	buff[size - 1] = '\n';
 	memcpy(buff + size, uudata, uusize);