From f084b0568ac2845f12a9a34e0636811d49d6a2a8 Mon Sep 17 00:00:00 2001

From: Tim Kientzle <kientzle@acm.org>

Date: Sun, 19 Jun 2016 14:14:09 -0700

Subject: [PATCH] Issue #718: Fix TALOS-CAN-152

If a 7-Zip archive declares a rediculously large number of substreams,

it can overflow an internal counter, leading a subsequent memory

allocation to be too small for the substream data.

Thanks to the Open Source and Threat Intelligence project at Cisco

for reporting this issue.

---

 libarchive/archive_read_support_format_7zip.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/libarchive/archive_read_support_format_7zip.c b/libarchive/archive_read_support_format_7zip.c

index e490c00..8ae8443 100644

--- a/libarchive/archive_read_support_format_7zip.c

+++ b/libarchive/archive_read_support_format_7zip.c

@@ -2054,6 +2054,9 @@ read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,

 				return (-1);

 			if (1000000 < f[i].numUnpackStreams)

 				return (-1);

+			if (unpack_streams > SIZE_MAX - 1000000) {

+				return (-1);

+			}

 			unpack_streams += (size_t)f[i].numUnpackStreams;

 		}

 		if ((p = header_bytes(a, 1)) == NULL)

-- 

2.7.4