From 53d73345410d69e68171f05facaf4523e38e72bb Mon Sep 17 00:00:00 2001 From: Martin Matuska Date: Fri, 2 Dec 2016 10:08:02 +0100 Subject: [PATCH] Fix heap buffer overflow in uudecode_bidder_bid() Reported-by: OSS-Fuzz issue 139, 145, 152 --- libarchive/archive_read_support_filter_uu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libarchive/archive_read_support_filter_uu.c b/libarchive/archive_read_support_filter_uu.c index 787a619f2..f0fc14870 100644 --- a/libarchive/archive_read_support_filter_uu.c +++ b/libarchive/archive_read_support_filter_uu.c @@ -312,6 +312,7 @@ uudecode_bidder_bid(struct archive_read_filter_bidder *self, avail -= len; if (l == 6) { + /* "begin " */ if (!uuchar[*b]) return (0); /* Get a length of decoded bytes. */ @@ -352,8 +353,8 @@ uudecode_bidder_bid(struct archive_read_filter_bidder *self, b += nl; if (avail && uuchar[*b]) return (firstline+30); - } - if (l == 13) { + } else if (l == 13) { + /* "begin-base64 " */ while (len-nl > 0) { if (!base64[*b++]) return (0); -- 2.47.2