Blame SOURCES/libarchive-3.5.3-Fix-CVE-2022-26280.patch
|
 |
6a5619 |
# Patch sources from libarchive upstream
|
|
|
6a5619 |
# Source: https://github.com/libarchive/libarchive/commit/cfaa28168a07ea4a53276b63068f94fce37d6aff
|
|
|
6a5619 |
|
|
|
6a5619 |
--- libarchive-3.5.3/libarchive/archive_read_support_format_zip.c.old 2022-05-18 08:55:50.861574517 +0000
|
|
|
6a5619 |
+++ libarchive-3.5.3/libarchive/archive_read_support_format_zip.c 2022-05-18 08:57:03.049574517 +0000
|
|
|
6a5619 |
@@ -1657,7 +1657,7 @@ zipx_lzma_alone_init(struct archive_read
|
|
|
6a5619 |
*/
|
|
|
6a5619 |
|
|
|
6a5619 |
/* Read magic1,magic2,lzma_params from the ZIPX stream. */
|
|
|
6a5619 |
- if((p = __archive_read_ahead(a, 9, NULL)) == NULL) {
|
|
|
6a5619 |
+ if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) {
|
|
|
6a5619 |
archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
|
|
|
6a5619 |
"Truncated lzma data");
|
|
|
6a5619 |
return (ARCHIVE_FATAL);
|