Merge pull request #3019 from kientzle/kientzle-sparse-uaf-012

[sparse] UAF in sparse_reset

(cherry picked from commit f5166ca923a7aa97dd8a36a6233c7c6b3303594c)

diff --git a/libarchive/archive_entry_sparse.c b/libarchive/archive_entry_sparse.c
index c430896119fb8444b638e5279de206a581a876c9..1e84ff7f8589162152d7f7621f6d1e9ed3a03c8a 100644 (file)
--- a/libarchive/archive_entry_sparse.c
+++ b/libarchive/archive_entry_sparse.c
@@ -127,9 +127,10 @@ archive_entry_sparse_count(struct archive_entry *entry)
 int
 archive_entry_sparse_reset(struct archive_entry * entry)
 {
+       /* Counting can change sparse_head, so do it first */
+       int count = archive_entry_sparse_count(entry);
        entry->sparse_p = entry->sparse_head;
-
-       return archive_entry_sparse_count(entry);
+       return (count);
 }
 
 int