From: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun, 9 Aug 2026 13:11:13 +0000 (+0300)
Subject: liblzma: Fix a theoretical integer overflow in lzma_index_cat()
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fxz.git

liblzma: Fix a theoretical integer overflow in lzma_index_cat()

To trigger it, one would need to successfully allocate hundreds of
gigabytes of memory.
---

diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c
index 099f21d7..0492f960 100644
--- a/src/liblzma/common/index.c
+++ b/src/liblzma/common/index.c
@@ -807,6 +807,11 @@ lzma_index_cat(lzma_index *restrict dest, lzma_index *restrict src,
 	if (dest == NULL || src == NULL)
 		return LZMA_PROG_ERROR;
 
+	// Check that we don't exceed the maximum number of Streams
+	// per lzma_index.
+	if (STREAMS_MAX - dest->streams.count < src->streams.count)
+		return LZMA_DATA_ERROR;
+
 	const lzma_vli dest_file_size = lzma_index_file_size(dest);
 
 	// Check that we don't exceed the file size limits.