From: 0xmrniko <ap7737586@gmail.com>
Date: Sun, 19 Jul 2026 13:12:05 +0000 (+0530)
Subject: Guard RAR seek cursor before previous block lookup
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e548c9942389482dae2c394d03e4aea65b440ff1;p=thirdparty%2Flibarchive.git

Guard RAR seek cursor before previous block lookup
---

diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index 801f26997..36d0e0831 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -1293,6 +1293,12 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
               "Error during seek of RAR file");
             return (ARCHIVE_FAILED);
           }
+          if (rar->cursor == 0)
+          {
+            archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+              "Invalid RAR seek cursor state");
+            return (ARCHIVE_FAILED);
+          }
           client_offset += rar->dbo[rar->cursor].start_offset -
             rar->dbo[rar->cursor-1].end_offset;
           continue;