From: Kaif Khan <kaif@bugqore.com>
Date: Tue, 14 Jul 2026 13:16:00 +0000 (+0530)
Subject: pax: use checked size arithmetic in base64_encode
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=992cf1fc0b4361cbf8afa4bee1e4767fd4a11954;p=thirdparty%2Flibarchive.git

pax: use checked size arithmetic in base64_encode
---

diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
index 4dc627c56..8c90cf01b 100644
--- a/libarchive/archive_write_set_format_pax.c
+++ b/libarchive/archive_write_set_format_pax.c
@@ -2134,9 +2134,16 @@ base64_encode(const char *s, size_t len)
 	      '8','9','+','/' };
 	uint32_t v;
 	char *d, *out;
+	size_t out_len;
 
 	/* 3 bytes becomes 4 chars, but round up and allow for trailing NUL */
-	out = malloc((len * 4 + 2) / 3 + 1);
+	if (archive_ckd_mul_size(&out_len, len, 4) ||
+	    archive_ckd_add_size(&out_len, out_len, 2))
+		return (NULL);
+	out_len = out_len / 3;
+	if (archive_ckd_add_size(&out_len, out_len, 1))
+		return (NULL);
+	out = malloc(out_len);
 	if (out == NULL)
 		return (NULL);
 	d = out;