Author: delphij
Date: Tue Feb 23 07:13:22 2016
New Revision: 295914
URL: https://svnweb.freebsd.org/changeset/base/295914
Log:
MFV r295913:
Partially apply upstream changeset 6e06b1c8 (kientzle).
Limit filter recursion level to 25 (instead of infinite). This fixes a
potential crash issue discovered by Alexander Cherepanov.
PR: 207362
Reported by: Robert Clausecker
Obtained from: libarchive github project
Modified:
head/contrib/libarchive/libarchive/archive_read.c
Directory Properties:
head/contrib/libarchive/ (props changed)
head/contrib/libarchive/libarchive/ (props changed)
Modified: head/contrib/libarchive/libarchive/archive_read.c
==============================================================================
--- head/contrib/libarchive/libarchive/archive_read.c Tue Feb 23 07:04:54
2016 (r295913)
+++ head/contrib/libarchive/libarchive/archive_read.c Tue Feb 23 07:13:22
2016 (r295914)
@@ -545,13 +545,13 @@ archive_read_open1(struct archive *_a)
static int
choose_filters(struct archive_read *a)
{
- int number_bidders, i, bid, best_bid;
+ int number_bidders, i, bid, best_bid, n;
struct archive_read_filter_bidder *bidder, *best_bidder;
struct archive_read_filter *filter;
ssize_t avail;
int r;
- for (;;) {
+ for (n = 0; n < 25; ++n) {
number_bidders = sizeof(a->bidders) / sizeof(a->bidders[0]);
best_bid = 0;
@@ -597,6 +597,9 @@ choose_filters(struct archive_read *a)
return (ARCHIVE_FATAL);
}
}
+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+ "Input requires too many filters for decoding");
+ return (ARCHIVE_FATAL);
}
/*
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
