Date: Sat, 23 Mar 2013 21:34:11 +0000 (UTC) From: Martin Matuska <mm@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r248664 - head/contrib/libarchive/libarchive Message-ID: <201303232134.r2NLYBcs092759@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mm Date: Sat Mar 23 21:34:10 2013 New Revision: 248664 URL: http://svnweb.freebsd.org/changeset/base/248664 Log: Merge bugfix from vendor master branch: Limit write requests to at most INT_MAX. This prevents a certain common programming error (passing -1 to write) from leading to other problems deeper in the library. References: https://github.com/libarchive/libarchive/commit/22531545514043e0 Reported by: Xin Li <delphij@FreeBSD.org> Obtained from: libarchive (master branch) Modified: head/contrib/libarchive/libarchive/archive_write.c Modified: head/contrib/libarchive/libarchive/archive_write.c ============================================================================== --- head/contrib/libarchive/libarchive/archive_write.c Sat Mar 23 20:46:47 2013 (r248663) +++ head/contrib/libarchive/libarchive/archive_write.c Sat Mar 23 21:34:10 2013 (r248664) @@ -671,8 +671,13 @@ static ssize_t _archive_write_data(struct archive *_a, const void *buff, size_t s) { struct archive_write *a = (struct archive_write *)_a; + const size_t max_write = INT_MAX; + archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC, ARCHIVE_STATE_DATA, "archive_write_data"); + /* In particular, this catches attempts to pass negative values. */ + if (s > max_write) + s = max_write; archive_clear_error(&a->archive); return ((a->format_write_data)(a, buff, s)); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201303232134.r2NLYBcs092759>