Skip to content

Commit b8592ec

Browse files
committed
RAR reader: fix use after free
If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed to continue with next archive headers. We need to set rar->start_new_table after the ppmd7_context got freed, otherwise it won't be allocated again. Reported by: OSS-Fuzz issue 2582
1 parent 313fa21 commit b8592ec

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

Diff for: libarchive/archive_read_support_format_rar.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -1024,8 +1024,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
10241024
case COMPRESS_METHOD_GOOD:
10251025
case COMPRESS_METHOD_BEST:
10261026
ret = read_data_compressed(a, buff, size, offset);
1027-
if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
1027+
if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
10281028
__archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1029+
rar->start_new_table = 1;
1030+
}
10291031
break;
10301032

10311033
default:

0 commit comments

Comments
 (0)