|
 |
e462fc |
From 738a3c456b52704ce2c45e10c7290db0d6fe3141 Mon Sep 17 00:00:00 2001
|
|
|
e462fc |
From: =?UTF-8?q?Patrik=20Novotn=C3=BD?= <panovotn@redhat.com>
|
|
|
e462fc |
Date: Wed, 15 Jan 2020 16:29:27 +0100
|
|
|
e462fc |
Subject: [PATCH] RAR reader: fix use after free
|
|
|
e462fc |
|
|
|
e462fc |
If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
|
|
|
e462fc |
to continue with next archive headers. We need to set rar->start_new_table
|
|
|
e462fc |
after the ppmd7_context got freed, otherwise it won't be allocated again.
|
|
|
e462fc |
---
|
|
|
e462fc |
libarchive/archive_read_support_format_rar.c | 4 +++-
|
|
|
e462fc |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
e462fc |
|
|
|
e462fc |
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
|
|
|
e462fc |
index c95c78c..7765f27 100644
|
|
|
e462fc |
--- a/libarchive/archive_read_support_format_rar.c
|
|
|
e462fc |
+++ b/libarchive/archive_read_support_format_rar.c
|
|
|
e462fc |
@@ -966,8 +966,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
|
|
|
e462fc |
case COMPRESS_METHOD_GOOD:
|
|
|
e462fc |
case COMPRESS_METHOD_BEST:
|
|
|
e462fc |
ret = read_data_compressed(a, buff, size, offset);
|
|
|
e462fc |
- if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
|
|
|
e462fc |
+ if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
|
|
|
e462fc |
__archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context, &g_szalloc);
|
|
|
e462fc |
+ rar->start_new_table = 1;
|
|
|
e462fc |
+ }
|
|
|
e462fc |
break;
|
|
|
e462fc |
|
|
|
e462fc |
default:
|
|
|
e462fc |
--
|
|
|
e462fc |
2.24.1
|
|
|
e462fc |
|