Skip to content

Commit

Permalink
rar: Fix OOB access with unicode filenames
Browse files Browse the repository at this point in the history
Prevent out of boundary accesses by revalidating offset every time it
is incremented.
  • Loading branch information
stoeckmann committed May 21, 2024
1 parent 8fc0569 commit bb065c6
Showing 1 changed file with 16 additions and 2 deletions.
18 changes: 16 additions & 2 deletions libarchive/archive_read_support_format_rar.c
Original file line number Diff line number Diff line change
Expand Up @@ -1544,7 +1544,7 @@ read_header(struct archive_read *a, struct archive_entry *entry,
fn_end = filename_size * 2;
filename_size = 0;
offset = (unsigned)strlen(filename) + 1;
highbyte = *(p + offset++);
highbyte = offset >= end ? 0 : *(p + offset++);
flagbits = 0;
flagbyte = 0;
while (offset < end && filename_size < fn_end)
Expand All @@ -1559,24 +1559,38 @@ read_header(struct archive_read *a, struct archive_entry *entry,
switch((flagbyte >> flagbits) & 3)
{
case 0:
if (offset >= end)
continue;
filename[filename_size++] = '\0';
filename[filename_size++] = *(p + offset++);
break;
case 1:
if (offset >= end)
continue;
filename[filename_size++] = highbyte;
filename[filename_size++] = *(p + offset++);
break;
case 2:
if (offset >= end - 1) {
offset = end;
continue;
}
filename[filename_size++] = *(p + offset + 1);
filename[filename_size++] = *(p + offset);
offset += 2;
break;
case 3:
{
char extra, high;
uint8_t length = *(p + offset++);
uint8_t length;

if (offset >= end)
continue;

length = *(p + offset++);
if (length & 0x80) {
if (offset >= end)
continue;
extra = *(p + offset++);
high = (char)highbyte;
} else
Expand Down

0 comments on commit bb065c6

Please sign in to comment.