Merge pull request #2929 from stoeckmann/7zip_codec_id

7zip: Verify that Codec ID fits into 63 bit
(cherry picked from commit abed05f954fc2749d75e0a0254c91af23f9a1358)

diff --git a/libarchive/archive_read_support_format_7zip.c b/libarchive/archive_read_support_format_7zip.c
index 325e0e9ddb771316489a01ea2a41fa8dc5fefea5..3084e77e6ff007d1c9911e0830988bd015582dc0 100644 (file)
--- a/libarchive/archive_read_support_format_7zip.c
+++ b/libarchive/archive_read_support_format_7zip.c
@@ -175,7 +175,7 @@ struct _7z_digests {
 struct _7z_folder {
        uint64_t                 numCoders;
        struct _7z_coder {
-               unsigned long    codec;
+               uint64_t         codec;
                uint64_t         numInStreams;
                uint64_t         numOutStreams;
                uint64_t         propertiesSize;
@@ -409,7 +409,7 @@ static int  archive_read_format_7zip_read_data_skip(struct archive_read *);
 static int     archive_read_format_7zip_read_header(struct archive_read *,
                    struct archive_entry *);
 static int     check_7zip_header_in_sfx(const unsigned char *);
-static unsigned long decode_codec_id(const unsigned char *, size_t);
+static int     decode_codec_id(const unsigned char *, size_t, uint64_t *);
 static int     decode_encoded_header_info(struct archive_read *,
                    struct _7z_stream_info *);
 static int     decompress(struct archive_read *, struct _7zip *,
@@ -1289,17 +1289,20 @@ set_error(struct archive_read *a, int ret)
 
 #endif
 
-static unsigned long
-decode_codec_id(const unsigned char *codecId, size_t id_size)
+static int
+decode_codec_id(const unsigned char *codecId, size_t id_size, uint64_t *id)
 {
        unsigned i;
-       unsigned long id = 0;
+       uint64_t v = 0;
 
        for (i = 0; i < id_size; i++) {
-               id <<= 8;
-               id += codecId[i];
+               if (v > (uint64_t)INT64_MAX / 256)
+                       return (-1);
+               v <<= 8;
+               v += codecId[i];
        }
-       return (id);
+       *id = v;
+       return (0);
 }
 
 static Byte
@@ -2287,7 +2290,8 @@ read_Folder(struct archive_read *a, struct _7z_folder *f)
                if ((p = header_bytes(a, codec_size)) == NULL)
                        return (-1);
 
-               f->coders[i].codec = decode_codec_id(p, codec_size);
+               if (decode_codec_id(p, codec_size, &f->coders[i].codec) < 0)
+                       return (-1);
 
                if (simple) {
                        f->coders[i].numInStreams = 1;