From: Tobias Stoeckmann Date: Sun, 11 May 2025 00:17:19 +0000 (+0200) Subject: rar: Fix double free with over 4 billion nodes (#2598) X-Git-Tag: v3.8.0~26 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=09685126fcec664e2b8ca595e1fc371bd494d209;p=thirdparty%2Flibarchive.git rar: Fix double free with over 4 billion nodes (#2598) If a system is capable of handling 4 billion nodes in memory, a double free could occur because of an unsigned integer overflow leading to a realloc call with size argument of 0. Eventually, the client will release that memory again, triggering a double free. Signed-off-by: Tobias Stoeckmann --- diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c index 542532dd7..197469b97 100644 --- a/libarchive/archive_read_support_format_rar.c +++ b/libarchive/archive_read_support_format_rar.c @@ -335,8 +335,8 @@ struct rar int found_first_header; char has_endarc_header; struct data_block_offsets *dbo; - unsigned int cursor; - unsigned int nodes; + size_t cursor; + size_t nodes; char filename_must_match; /* LZSS members */ @@ -1192,7 +1192,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset, int whence) { int64_t client_offset, ret; - unsigned int i; + size_t i; struct rar *rar = (struct rar *)(a->format->data); if (rar->compression_method == COMPRESS_METHOD_STORE)