blob: a61cc3b6a9d7021d024d696167aa2d1eaa490cbc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
From c778d234c396e78bacef7c9bff0dd2bb9fb6aac8 Mon Sep 17 00:00:00 2001
From: shixuantong <1726671442@qq.com>
Date: Wed, 6 Apr 2022 17:40:57 +0800
Subject: [PATCH] Ensure that sz is greater than 0.
Authored by shixuantong <1726671442@qq.com>.
meta-openembedded uses Debian's release tarball [1]. Debian uses
repo.or.cz/libtar.git as their upstream [2]. repo.or.cz/libtar.git has
been inactive since 2013 [3].
CVE: CVE-2021-33643 CVE-2021-33644
Upstream-Status: Inactive-Upstream [lastrelease: 2013 lastcommit: 2013]
[1] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=master#n8
[2] http://svn.kibibyte.se/libtar/trunk/debian/control (rev 51; not tagged)
[3] https://repo.or.cz/libtar.git/shortlog/refs/heads/master
Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com>
---
lib/block.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/lib/block.c b/lib/block.c
index 092bc28..f12c4bc 100644
--- a/lib/block.c
+++ b/lib/block.c
@@ -118,6 +118,11 @@ th_read(TAR *t)
if (TH_ISLONGLINK(t))
{
sz = th_get_size(t);
+ if ((int)sz <= 0)
+ {
+ errno = EINVAL;
+ return -1;
+ }
blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0);
if (blocks > ((size_t)-1 / T_BLOCKSIZE))
{
@@ -168,6 +173,11 @@ th_read(TAR *t)
if (TH_ISLONGNAME(t))
{
sz = th_get_size(t);
+ if ((int)sz <= 0)
+ {
+ errno = EINVAL;
+ return -1;
+ }
blocks = (sz / T_BLOCKSIZE) + (sz % T_BLOCKSIZE ? 1 : 0);
if (blocks > ((size_t)-1 / T_BLOCKSIZE))
{
|
