svn commit: trunk/busybox/archival/libunarchive

[landley at busybox.net]

Author: landley
Date: 2006-02-16 21:19:40 -0800 (Thu, 16 Feb 2006)
New Revision: 14086

Log:
Fix for an integer overflow bug that could cause a segfault on certain
pathological archives.

(Unlikely to have security implications, the only way to trigger it basically
wound up doing memset(dbuf,x,2^31) and triggering an immediate segfault.  The
test basically gives us a more polite error message.)

Thanks to Ned Ludd and the Gentoo security guys for finding this.


Modified:
   trunk/busybox/archival/libunarchive/decompress_bunzip2.c


Changeset:
Modified: trunk/busybox/archival/libunarchive/decompress_bunzip2.c
===================================================================
--- trunk/busybox/archival/libunarchive/decompress_bunzip2.c	2006-02-17 05:12:03 UTC (rev 14085)
+++ trunk/busybox/archival/libunarchive/decompress_bunzip2.c	2006-02-17 05:19:40 UTC (rev 14086)
@@ -413,7 +413,7 @@
 			   context).  Thus space is saved. */
 
 			t += (runPos << nextSym); /* +runPos if RUNA; +2*runPos if RUNB */
-			runPos <<= 1;
+			if(runPos < dbufSize) runPos <<= 1;
 			goto end_of_huffman_loop;
 		}