Reject LHA archive entries with negative size.

diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c
index b8ef4ae10eceda9fadadc4f664010407df6a76b9..95c99bb1f31e848892dc6ab96bbba55fae9c5284 100644 (file)
--- a/libarchive/archive_read_support_format_lha.c
+++ b/libarchive/archive_read_support_format_lha.c
@@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_read *a,
         * Prepare variables used to read a file content.
         */
        lha->entry_bytes_remaining = lha->compsize;
+       if (lha->entry_bytes_remaining < 0) {
+               archive_set_error(&a->archive,
+                   ARCHIVE_ERRNO_FILE_FORMAT,
+                   "Invalid LHa entry size");
+               return (ARCHIVE_FATAL);
+       }
        lha->entry_offset = 0;
        lha->entry_crc_calculated = 0;