uu: fix null pointer UB in EOF buffering

The uu filter can keep a partial encoded line in its internal input
buffer, then reach upstream EOF with no new bytes available. In that
case, d is NULL and avail_in is zero, but the buffered-input path still
passes d to memcpy() before processing the saved bytes.

Skip the append copy when avail_in is zero so the saved input is handled
without passing a null source pointer to memcpy().

diff --git a/libarchive/archive_read_support_filter_uu.c b/libarchive/archive_read_support_filter_uu.c
index 714c7e836170b1b36b3af5b52a42593e42da64f9..c62ed0896c7903724ac62676c5ca60ebab45d79b 100644 (file)
--- a/libarchive/archive_read_support_filter_uu.c
+++ b/libarchive/archive_read_support_filter_uu.c
@@ -498,8 +498,9 @@ read_more:
                if (ensure_in_buff_size(self, uudecode,
                    avail_in + uudecode->in_cnt) != ARCHIVE_OK)
                        return (ARCHIVE_FATAL);
-               memcpy(uudecode->in_buff + uudecode->in_cnt,
-                   d, avail_in);
+               if (avail_in > 0)
+                       memcpy(uudecode->in_buff + uudecode->in_cnt,
+                           d, avail_in);
                d = uudecode->in_buff;
                avail_in += uudecode->in_cnt;
                uudecode->in_cnt = 0;