From 45a873e998297f2a9970507238d1a0510a0dae09 Mon Sep 17 00:00:00 2001 From: AZero13 Date: Tue, 4 Nov 2025 19:02:08 -0500 Subject: [PATCH] Bounds check newdir_len Honestly, this is of little consequence; if old_len is too big the program will crash anyway. However, an error exists just in case. --- tar/util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tar/util.c b/tar/util.c index fc5e15cb0..6e41e49de 100644 --- a/tar/util.c +++ b/tar/util.c @@ -314,7 +314,10 @@ set_chdir(struct bsdtar *bsdtar, const char *newdir) /* The -C /foo -C bar case; concatenate */ char *old_pending = bsdtar->pending_chdir; size_t old_len = strlen(old_pending); - size_t new_len = old_len + strlen(newdir) + 2; + size_t newdir_len = strlen(newdir); + size_t new_len = old_len + newdir_len + 2; + if (old_len > SIZE_MAX - newdir_len - 2) + lafe_errc(1, errno, "Path too long"); bsdtar->pending_chdir = malloc(new_len); if (old_pending[old_len - 1] == '/') old_pending[old_len - 1] = '\0'; -- 2.47.3