revi-archive/xz-archive
1
0
Fork 0
mirror of https://git.tukaani.org/xz.git synced 2024-04-04 12:36:23 +02:00
Code Activity

liblzma: lzma_index_append: Add missing integer overflow check.

Browse source 
The documentation in src/liblzma/api/lzma/index.h suggests that
both the unpadded (compressed) size and the uncompressed size
are checked for overflow, but only the unpadded size was checked.
The uncompressed check is done first since that is more likely to
occur than the unpadded or index field size overflows.
This commit is contained in:
Jia Tan 2022-09-02 20:18:55 +08:00 committed by Lasse Collin
parent 20d82bc907
commit 72e1645a43
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/liblzma/common/index.c
View file

@ -656,6 +656,10 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator,
const uint32_t index_list_size_add = lzma_vli_size(unpadded_size) const uint32_t index_list_size_add = lzma_vli_size(unpadded_size)
+ lzma_vli_size(uncompressed_size); + lzma_vli_size(uncompressed_size);
// Check that uncompressed size will not overflow.
if (uncompressed_base + uncompressed_size > LZMA_VLI_MAX)
return LZMA_DATA_ERROR;
// Check that the file size will stay within limits. // Check that the file size will stay within limits.
if (index_file_size(s->node.compressed_base, if (index_file_size(s->node.compressed_base,
compressed_base + unpadded_size, s->record_count + 1, compressed_base + unpadded_size, s->record_count + 1,