From: Martin Matuska <martin@matuska.org>
Date: Thu, 8 Dec 2016 01:45:41 +0000 (+0100)
Subject: Do not read beyond strtab table size in _ar_read_header()
X-Git-Tag: v3.3.0~94
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f167e8d9d521e5536b37098501c6396ab65452e6;p=thirdparty%2Flibarchive.git

Do not read beyond strtab table size in _ar_read_header()

Reported-by:	OSS-Fuzz issue 237
---

diff --git a/libarchive/archive_read_support_format_ar.c b/libarchive/archive_read_support_format_ar.c
index ff81f5fb7..b6b9fc3c6 100644
--- a/libarchive/archive_read_support_format_ar.c
+++ b/libarchive/archive_read_support_format_ar.c
@@ -315,7 +315,7 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
 		 * If we can't look up the real name, warn and return
 		 * the entry with the wrong name.
 		 */
-		if (ar->strtab == NULL || number > ar->strtab_size) {
+		if (ar->strtab == NULL || number >= ar->strtab_size) {
 			archive_set_error(&a->archive, EINVAL,
 			    "Can't find long filename for GNU/SVR4 archive entry");
 			archive_entry_copy_pathname(entry, filename);