From: terrynini <terrynini38514@gmail.com>
Date: Wed, 14 Aug 2024 08:01:21 +0000 (+0800)
Subject: Fix CVE-2024-26256 (#2269)
X-Git-Tag: v3.7.5~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b7b0c7c4379531206a53634a12a02a8d45b28a2f;p=thirdparty%2Flibarchive.git

Fix CVE-2024-26256 (#2269)

Opening a manipulated RAR archive could lead to remote code execution

Security: CVE-2024-26256
Co-authored-by: Timothy Lyanguzov <theta682@gmail.com>
---

diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index fb7cfde7b..f4dcb7528 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -3428,6 +3428,12 @@ run_filters(struct archive_read *a)
       return 0;
   }
 
+  if (filter->blocklength > VM_MEMORY_SIZE)
+  {
+    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, "Bad RAR file data");
+    return 0;
+  }
+
   ret = copy_from_lzss_window(a, filters->vm->memory, start, filter->blocklength);
   if (ret != ARCHIVE_OK)
     return 0;