From 4f5a7af80831cedaa25eb23b054768dbfebaabb0 Mon Sep 17 00:00:00 2001 From: Martin Matuska Date: Mon, 6 Feb 2017 03:07:33 +0100 Subject: [PATCH] WARC reader: skip whitespace and check for first digit in _warc_rdlen() Fixes possible heap-buffer-overflow. Reported-By: OSS-Fuzz issue 552 --- libarchive/archive_read_support_format_warc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libarchive/archive_read_support_format_warc.c b/libarchive/archive_read_support_format_warc.c index 3f150986b..5e22438d2 100644 --- a/libarchive/archive_read_support_format_warc.c +++ b/libarchive/archive_read_support_format_warc.c @@ -730,7 +730,12 @@ _warc_rdlen(const char *buf, size_t bsz) return -1; } - /* strtol kindly overreads whitespace for us, so use that */ + /* skip leading whitespace */ + while (val < eol && isblank(*val)) + val++; + /* there must be at least one digit */ + if (!isdigit(*val)) + return -1; len = strtol(val, &on, 10); if (on != eol) { /* line must end here */ -- 2.47.2