From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 9 May 2026 02:04:25 +0000 (-0700)
Subject: Merge pull request #3019 from kientzle/kientzle-sparse-uaf-012
X-Git-Tag: v3.8.8~134
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=63dbb419331dee6bdb07503c2033960e321c4ae9;p=thirdparty%2Flibarchive.git

Merge pull request #3019 from kientzle/kientzle-sparse-uaf-012

[sparse] UAF in sparse_reset

(cherry picked from commit f5166ca923a7aa97dd8a36a6233c7c6b3303594c)
---

diff --git a/libarchive/archive_entry_sparse.c b/libarchive/archive_entry_sparse.c
index c43089611..1e84ff7f8 100644
--- a/libarchive/archive_entry_sparse.c
+++ b/libarchive/archive_entry_sparse.c
@@ -127,9 +127,10 @@ archive_entry_sparse_count(struct archive_entry *entry)
 int
 archive_entry_sparse_reset(struct archive_entry * entry)
 {
+	/* Counting can change sparse_head, so do it first */
+	int count = archive_entry_sparse_count(entry);
 	entry->sparse_p = entry->sparse_head;
-
-	return archive_entry_sparse_count(entry);
+	return (count);
 }
 
 int