Skip to content
Permalink
Browse files

RAR reader: fix use after free

If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
to continue with next archive headers. We need to set rar->start_new_table
after the ppmd7_context got freed, otherwise it won't be allocated again.

Reported by: OSS-Fuzz issue 2582
  • Loading branch information...
mmatuska committed May 11, 2019
1 parent 313fa21 commit b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60
Showing with 3 additions and 1 deletion.
  1. +3 −1 libarchive/archive_read_support_format_rar.c
@@ -1024,8 +1024,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
case COMPRESS_METHOD_GOOD:
case COMPRESS_METHOD_BEST:
ret = read_data_compressed(a, buff, size, offset);
if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
__archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
rar->start_new_table = 1;
}
break;

default:

1 comment on commit b8592ec

@wu610777031

This comment has been minimized.

Copy link

wu610777031 commented on b8592ec Nov 8, 2019

CVE-2019-18408

Please sign in to comment.
You can’t perform that action at this time.