From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 9 May 2026 01:48:45 +0000 (-0700)
Subject: [sparse] UAF in sparse_reset
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b1622a8e5531381952fd2f12efeb344dae9fc488;p=thirdparty%2Flibarchive.git

[sparse] UAF in sparse_reset
---

diff --git a/libarchive/archive_entry_sparse.c b/libarchive/archive_entry_sparse.c
index c43089611..1e84ff7f8 100644
--- a/libarchive/archive_entry_sparse.c
+++ b/libarchive/archive_entry_sparse.c
@@ -127,9 +127,10 @@ archive_entry_sparse_count(struct archive_entry *entry)
 int
 archive_entry_sparse_reset(struct archive_entry * entry)
 {
+	/* Counting can change sparse_head, so do it first */
+	int count = archive_entry_sparse_count(entry);
 	entry->sparse_p = entry->sparse_head;
-
-	return archive_entry_sparse_count(entry);
+	return (count);
 }
 
 int