From: Sergey Poznyakoff <gray@gnu.org>
Date: Sat, 28 Aug 2021 11:15:25 +0000 (+0300)
Subject: Handle invalid sparse entries in pax header
X-Git-Tag: v1.35~102
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=cc8f5f78b2437f50f0972433275b910b10d46717;p=thirdparty%2Ftar.git

Handle invalid sparse entries in pax header

* src/sparse.c (pax_decode_header): Check if sp.offset+sp.numbytes
falls within the reported file size.  Check for possible integer
overflow.
---

diff --git a/src/sparse.c b/src/sparse.c
index 2ebc6212..7587edb2 100644
--- a/src/sparse.c
+++ b/src/sparse.c
@@ -1309,7 +1309,9 @@ pax_decode_header (struct tar_sparse_file *file)
 	    }
 	  sp.offset = u;
 	  COPY_BUF (blk,nbuf,p);
-	  if (!decode_num (&u, nbuf, TYPE_MAXIMUM (off_t)))
+	  if (!decode_num (&u, nbuf, TYPE_MAXIMUM (off_t))
+	      || INT_ADD_OVERFLOW (sp.offset, u)
+	      || file->stat_info->stat.st_size < sp.offset + u)
 	    {
 	      ERROR ((0, 0, _("%s: malformed sparse archive member"),
 		      file->stat_info->orig_file_name));