From c8b8ab2ef1eb0a0217ad2027d7f5d242ceb944d3 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Sun, 9 Aug 2026 16:11:13 +0300 Subject: [PATCH] liblzma: Fix a theoretical integer overflow in lzma_index_cat() To trigger it, one would need to successfully allocate hundreds of gigabytes of memory. --- src/liblzma/common/index.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c index 099f21d7..0492f960 100644 --- a/src/liblzma/common/index.c +++ b/src/liblzma/common/index.c @@ -807,6 +807,11 @@ lzma_index_cat(lzma_index *restrict dest, lzma_index *restrict src, if (dest == NULL || src == NULL) return LZMA_PROG_ERROR; + // Check that we don't exceed the maximum number of Streams + // per lzma_index. + if (STREAMS_MAX - dest->streams.count < src->streams.count) + return LZMA_DATA_ERROR; + const lzma_vli dest_file_size = lzma_index_file_size(dest); // Check that we don't exceed the file size limits. -- 2.47.3