From 09685126fcec664e2b8ca595e1fc371bd494d209 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Sun, 11 May 2025 02:17:19 +0200 Subject: [PATCH] rar: Fix double free with over 4 billion nodes (#2598) If a system is capable of handling 4 billion nodes in memory, a double free could occur because of an unsigned integer overflow leading to a realloc call with size argument of 0. Eventually, the client will release that memory again, triggering a double free. Signed-off-by: Tobias Stoeckmann --- libarchive/archive_read_support_format_rar.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c index 542532dd7..197469b97 100644 --- a/libarchive/archive_read_support_format_rar.c +++ b/libarchive/archive_read_support_format_rar.c @@ -335,8 +335,8 @@ struct rar int found_first_header; char has_endarc_header; struct data_block_offsets *dbo; - unsigned int cursor; - unsigned int nodes; + size_t cursor; + size_t nodes; char filename_must_match; /* LZSS members */ @@ -1192,7 +1192,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset, int whence) { int64_t client_offset, ret; - unsigned int i; + size_t i; struct rar *rar = (struct rar *)(a->format->data); if (rar->compression_method == COMPRESS_METHOD_STORE) -- 2.47.2