Blame SOURCES/libarchive-3.3.2-CVE-2019-18408.patch

f485a7
From 1abcbf1af5209631ccf4fca4ddcab3c863294c85 Mon Sep 17 00:00:00 2001
f485a7
From: =?UTF-8?q?Patrik=20Novotn=C3=BD?= <panovotn@redhat.com>
f485a7
Date: Wed, 15 Jan 2020 16:10:04 +0100
f485a7
Subject: [PATCH] RAR reader: fix use after free
f485a7
f485a7
If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
f485a7
to continue with next archive headers. We need to set rar->start_new_table
f485a7
after the ppmd7_context got freed, otherwise it won't be allocated again.
f485a7
---
f485a7
 libarchive/archive_read_support_format_rar.c | 4 +++-
f485a7
 1 file changed, 3 insertions(+), 1 deletion(-)
f485a7
f485a7
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
f485a7
index cbb14c32..9c26ef97 100644
f485a7
--- a/libarchive/archive_read_support_format_rar.c
f485a7
+++ b/libarchive/archive_read_support_format_rar.c
f485a7
@@ -1037,8 +1037,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
f485a7
   case COMPRESS_METHOD_GOOD:
f485a7
   case COMPRESS_METHOD_BEST:
f485a7
     ret = read_data_compressed(a, buff, size, offset);
f485a7
-    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
f485a7
+    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
fd59e7
       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
f485a7
+      rar->start_new_table = 1;
f485a7
+    }
f485a7
     break;
f485a7
 
f485a7
   default:
f485a7
-- 
f485a7
2.24.1
f485a7