pax: use checked size arithmetic in base64_encode

diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
index 4dc627c56ce4bef163b9c4a400e4b27da9d62d64..8c90cf01b534a0009a210918fd56330637e5ba6b 100644 (file)
--- a/libarchive/archive_write_set_format_pax.c
+++ b/libarchive/archive_write_set_format_pax.c
@@ -2134,9 +2134,16 @@ base64_encode(const char *s, size_t len)
              '8','9','+','/' };
        uint32_t v;
        char *d, *out;
+       size_t out_len;
 
        /* 3 bytes becomes 4 chars, but round up and allow for trailing NUL */
-       out = malloc((len * 4 + 2) / 3 + 1);
+       if (archive_ckd_mul_size(&out_len, len, 4) ||
+           archive_ckd_add_size(&out_len, out_len, 2))
+               return (NULL);
+       out_len = out_len / 3;
+       if (archive_ckd_add_size(&out_len, out_len, 1))
+               return (NULL);
+       out = malloc(out_len);
        if (out == NULL)
                return (NULL);
        d = out;