From: Michihiro NAKAJIMA <ggcueroad@gmail.com>
Date: Wed, 28 Apr 2010 11:52:20 +0000 (-0400)
Subject: Make sure the return value of get_path_component() is valid.
X-Git-Tag: v3.0.0a~1064
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a968f5c69d41fea6846756ac315a804afe6c9570;p=thirdparty%2Flibarchive.git

Make sure the return value of get_path_component() is valid.

SVN-Revision: 2328
---

diff --git a/libarchive/archive_write_set_format_iso9660.c b/libarchive/archive_write_set_format_iso9660.c
index 410416b1c..77ebd1df0 100644
--- a/libarchive/archive_write_set_format_iso9660.c
+++ b/libarchive/archive_write_set_format_iso9660.c
@@ -5388,6 +5388,18 @@ isoent_tree(struct archive_write *a, struct isoent *isoent)
 
 	for (;;) {
 		l = get_path_component(name, sizeof(name), fn);
+		if (l == 0) {
+			np = NULL;
+			break;
+		}
+		if (l < 0) {
+			archive_set_error(&a->archive,
+			    ARCHIVE_ERRNO_MISC,
+			    "A name buffer is too small");
+			_isoent_free(isoent);
+			return (NULL);
+		}
+
 		np = isoent_find_child(dent, name);
 		if (np == NULL || fn[0] == '\0')
 			break;
@@ -5441,6 +5453,14 @@ isoent_tree(struct archive_write *a, struct isoent *isoent)
 			if (fn[0] == '/')
 				fn++;
 			l = get_path_component(name, sizeof(name), fn);
+			if (l < 0) {
+				archive_string_free(&as);
+				archive_set_error(&a->archive,
+				    ARCHIVE_ERRNO_MISC,
+				    "A name buffer is too small");
+				_isoent_free(isoent);
+				return (NULL);
+			}
 			dent = np;
 		}