Author: delphij
Date: Wed Feb 24 05:40:03 2016
New Revision: 295961
URL: https://svnweb.freebsd.org/changeset/base/295961
Log:
MFC r295914: MFV r295913:
Partially apply upstream changeset 6e06b1c8 (kientzle).
Limit filter recursion level to 25 (instead of infinite). This fixes a
potential crash issue discovered by Alexander Cherepanov.
PR: 207362
Reported by: Robert Clausecker
Obtained from: libarchive github project
Approved by: re (marius)
Modified:
stable/10/contrib/libarchive/libarchive/archive_read.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/contrib/libarchive/libarchive/archive_read.c
==============================================================================
--- stable/10/contrib/libarchive/libarchive/archive_read.c Wed Feb 24
05:17:52 2016 (r295960)
+++ stable/10/contrib/libarchive/libarchive/archive_read.c Wed Feb 24
05:40:03 2016 (r295961)
@@ -545,13 +545,13 @@ archive_read_open1(struct archive *_a)
static int
choose_filters(struct archive_read *a)
{
- int number_bidders, i, bid, best_bid;
+ int number_bidders, i, bid, best_bid, n;
struct archive_read_filter_bidder *bidder, *best_bidder;
struct archive_read_filter *filter;
ssize_t avail;
int r;
- for (;;) {
+ for (n = 0; n < 25; ++n) {
number_bidders = sizeof(a->bidders) / sizeof(a->bidders[0]);
best_bid = 0;
@@ -597,6 +597,9 @@ choose_filters(struct archive_read *a)
return (ARCHIVE_FATAL);
}
}
+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+ "Input requires too many filters for decoding");
+ return (ARCHIVE_FATAL);
}
/*
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
