43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 09685126fcec664e2b8ca595e1fc371bd494d209 Mon Sep 17 00:00:00 2001
|
|
From: Tobias Stoeckmann <stoeckmann@users.noreply.github.com>
|
|
Date: Sun, 11 May 2025 02:17:19 +0200
|
|
Subject: [PATCH] rar: Fix double free with over 4 billion nodes (#2598)
|
|
|
|
If a system is capable of handling 4 billion nodes in memory, a double
|
|
free could occur because of an unsigned integer overflow leading to a
|
|
realloc call with size argument of 0. Eventually, the client will
|
|
release that memory again, triggering a double free.
|
|
|
|
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
|
|
---
|
|
libarchive/archive_read_support_format_rar.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
|
|
index 542532dd..197469b9 100644
|
|
--- a/libarchive/archive_read_support_format_rar.c
|
|
+++ b/libarchive/archive_read_support_format_rar.c
|
|
@@ -335,8 +335,8 @@ struct rar
|
|
int found_first_header;
|
|
char has_endarc_header;
|
|
struct data_block_offsets *dbo;
|
|
- unsigned int cursor;
|
|
- unsigned int nodes;
|
|
+ size_t cursor;
|
|
+ size_t nodes;
|
|
char filename_must_match;
|
|
|
|
/* LZSS members */
|
|
@@ -1192,7 +1192,7 @@ archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
|
|
int whence)
|
|
{
|
|
int64_t client_offset, ret;
|
|
- unsigned int i;
|
|
+ size_t i;
|
|
struct rar *rar = (struct rar *)(a->format->data);
|
|
|
|
if (rar->compression_method == COMPRESS_METHOD_STORE)
|
|
--
|
|
2.50.1
|
|
|