liblzma: Fix a theoretical integer overflow in lzma_index_cat()

To trigger it, one would need to successfully allocate hundreds of
gigabytes of memory.

diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c
index 099f21d72fb546a4e20056b022614b2f97322379..0492f9605965a6b77c3ed6ff802ddb084cad4f5c 100644 (file)
--- a/src/liblzma/common/index.c
+++ b/src/liblzma/common/index.c
@@ -807,6 +807,11 @@ lzma_index_cat(lzma_index *restrict dest, lzma_index *restrict src,
        if (dest == NULL || src == NULL)
                return LZMA_PROG_ERROR;
 
        if (dest == NULL || src == NULL)
                return LZMA_PROG_ERROR;
 

+       // Check that we don't exceed the maximum number of Streams
+       // per lzma_index.
+       if (STREAMS_MAX - dest->streams.count < src->streams.count)
+               return LZMA_DATA_ERROR;
+

        const lzma_vli dest_file_size = lzma_index_file_size(dest);
 
        // Check that we don't exceed the file size limits.
        const lzma_vli dest_file_size = lzma_index_file_size(dest);
 
        // Check that we don't exceed the file size limits.