CVS commit: src/external/bsd/libarchive/dist/libarchive

[Kamil Rytarowski]

Module Name:    src
Committed By:   kamil
Date:           Thu Feb 27 10:35:08 UTC 2020

Modified Files:
        src/external/bsd/libarchive/dist/libarchive:
            archive_read_support_format_xar.c

Log Message:
Fix undefined behavior in archive_read_support_format_xar()

Cherry-pick upstream patch:

>From 2cfda000bc5159d46fd8ead7d1bd3ea1f66f7948 Mon Sep 17 00:00:00 2001
From: Martin Matuska <mar...@matuska.org>
Date: Thu, 27 Feb 2020 01:54:19 +0100
Subject: [PATCH] XAR reader: initialize file_queue with 0 and memcpy() if
 allocated only

Fixes #1338


To generate a diff of this commit:
cvs rdiff -u -r1.1.1.4 -r1.2 \
    
src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c
diff -u src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c:1.1.1.4 src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c:1.2
--- src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c:1.1.1.4	Wed Jul 24 13:50:22 2019
+++ src/external/bsd/libarchive/dist/libarchive/archive_read_support_format_xar.c	Thu Feb 27 10:35:08 2020
@@ -458,6 +458,11 @@ archive_read_support_format_xar(struct a
 		return (ARCHIVE_FATAL);
 	}
 
+	/* initialize xar->file_queue */
+	xar->file_queue.allocated = 0;
+	xar->file_queue.used = 0;
+	xar->file_queue.files = NULL;
+
 	r = __archive_read_register_format(a,
 	    xar,
 	    "xar",
@@ -1221,10 +1226,12 @@ heap_add_entry(struct archive_read *a,
 	/* Expand our pending files list as necessary. */
 	if (heap->used >= heap->allocated) {
 		struct xar_file **new_pending_files;
-		int new_size = heap->allocated * 2;
+		int new_size;
 
 		if (heap->allocated < 1024)
 			new_size = 1024;
+		else
+			new_size = heap->allocated * 2;
 		/* Overflow might keep us from growing the list. */
 		if (new_size <= heap->allocated) {
 			archive_set_error(&a->archive,
@@ -1238,9 +1245,11 @@ heap_add_entry(struct archive_read *a,
 			    ENOMEM, "Out of memory");
 			return (ARCHIVE_FATAL);
 		}
-		memcpy(new_pending_files, heap->files,
-		    heap->allocated * sizeof(new_pending_files[0]));
-		free(heap->files);
+		if (heap->allocated) {
+			memcpy(new_pending_files, heap->files,
+			    heap->allocated * sizeof(new_pending_files[0]));
+			free(heap->files);
+		}
 		heap->files = new_pending_files;
 		heap->allocated = new_size;
 	}