|
 |
995285 |
From 3014e19820ea53c15c90f9d447ca3e668a0b76c6 Mon Sep 17 00:00:00 2001
|
|
|
995285 |
From: Tim Kientzle <kientzle@acm.org>
|
|
|
995285 |
Date: Sat, 28 May 2016 11:50:39 -0700
|
|
|
995285 |
Subject: [PATCH] Issue 711: Be more careful about verifying filename lengths
|
|
|
995285 |
when writing ISO9660 archives
|
|
|
995285 |
|
|
|
995285 |
* Don't cast size_t to int, since this can lead to overflow
|
|
|
995285 |
on machines where sizeof(int) < sizeof(size_t)
|
|
|
995285 |
* Check a + b > limit by writing it as
|
|
|
995285 |
a > limit || b > limit || a + b > limit
|
|
|
995285 |
to avoid problems when a + b wraps around.
|
|
|
995285 |
---
|
|
|
995285 |
libarchive/archive_write_set_format_iso9660.c | 18 ++++++++++--------
|
|
|
995285 |
1 file changed, 10 insertions(+), 8 deletions(-)
|
|
|
995285 |
|
|
|
995285 |
diff --git a/libarchive/archive_write_set_format_iso9660.c b/libarchive/archive_write_set_format_iso9660.c
|
|
|
995285 |
index 4d832fb..cb3e54e 100644
|
|
|
995285 |
--- a/libarchive/archive_write_set_format_iso9660.c
|
|
|
995285 |
+++ b/libarchive/archive_write_set_format_iso9660.c
|
|
|
995285 |
@@ -6225,7 +6225,7 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
unsigned char *p;
|
|
|
995285 |
size_t l;
|
|
|
995285 |
int r;
|
|
|
995285 |
- int ffmax, parent_len;
|
|
|
995285 |
+ size_t ffmax, parent_len;
|
|
|
995285 |
static const struct archive_rb_tree_ops rb_ops = {
|
|
|
995285 |
isoent_cmp_node_joliet, isoent_cmp_key_joliet
|
|
|
995285 |
};
|
|
|
995285 |
@@ -6239,7 +6239,7 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
else
|
|
|
995285 |
ffmax = 128;
|
|
|
995285 |
|
|
|
995285 |
- r = idr_start(a, idr, isoent->children.cnt, ffmax, 6, 2, &rb_ops);
|
|
|
995285 |
+ r = idr_start(a, idr, isoent->children.cnt, (int)ffmax, 6, 2, &rb_ops);
|
|
|
995285 |
if (r < 0)
|
|
|
995285 |
return (r);
|
|
|
995285 |
|
|
|
995285 |
@@ -6252,7 +6252,7 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
int ext_off, noff, weight;
|
|
|
995285 |
size_t lt;
|
|
|
995285 |
|
|
|
995285 |
- if ((int)(l = np->file->basename_utf16.length) > ffmax)
|
|
|
995285 |
+ if ((l = np->file->basename_utf16.length) > ffmax)
|
|
|
995285 |
l = ffmax;
|
|
|
995285 |
|
|
|
995285 |
p = malloc((l+1)*2);
|
|
|
995285 |
@@ -6285,7 +6285,7 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
/*
|
|
|
995285 |
* Get a length of MBS of a full-pathname.
|
|
|
995285 |
*/
|
|
|
995285 |
- if ((int)np->file->basename_utf16.length > ffmax) {
|
|
|
995285 |
+ if (np->file->basename_utf16.length > ffmax) {
|
|
|
995285 |
if (archive_strncpy_l(&iso9660->mbs,
|
|
|
995285 |
(const char *)np->identifier, l,
|
|
|
995285 |
iso9660->sconv_from_utf16be) != 0 &&
|
|
|
995285 |
@@ -6302,7 +6302,9 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
|
|
|
995285 |
/* If a length of full-pathname is longer than 240 bytes,
|
|
|
995285 |
* it violates Joliet extensions regulation. */
|
|
|
995285 |
- if (parent_len + np->mb_len > 240) {
|
|
|
995285 |
+ if (parent_len > 240
|
|
|
995285 |
+ || np->mb_len > 240
|
|
|
995285 |
+ || parent_len + np->mb_len > 240) {
|
|
|
995285 |
archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
|
|
|
995285 |
"The regulation of Joliet extensions;"
|
|
|
995285 |
" A length of a full-pathname of `%s' is "
|
|
|
995285 |
@@ -6314,11 +6316,11 @@ isoent_gen_joliet_identifier(struct archive_write *a, struct isoent *isoent,
|
|
|
995285 |
|
|
|
995285 |
/* Make an offset of the number which is used to be set
|
|
|
995285 |
* hexadecimal number to avoid duplicate identifier. */
|
|
|
995285 |
- if ((int)l == ffmax)
|
|
|
995285 |
+ if (l == ffmax)
|
|
|
995285 |
noff = ext_off - 6;
|
|
|
995285 |
- else if ((int)l == ffmax-2)
|
|
|
995285 |
+ else if (l == ffmax-2)
|
|
|
995285 |
noff = ext_off - 4;
|
|
|
995285 |
- else if ((int)l == ffmax-4)
|
|
|
995285 |
+ else if (l == ffmax-4)
|
|
|
995285 |
noff = ext_off - 2;
|
|
|
995285 |
else
|
|
|
995285 |
noff = ext_off;
|
|
|
995285 |
--
|
|
|
995285 |
2.7.4
|
|
|
995285 |
|