diff options
| author | Grzegorz Antoniak <ga@anadoxin.org> | 2019-12-18 19:28:12 +0100 |
|---|---|---|
| committer | Grzegorz Antoniak <ga@anadoxin.org> | 2019-12-21 20:22:34 +0100 |
| commit | c9267d665c30fa78023bd70b8e9c6f02450777e2 (patch) | |
| tree | 4601c1043dbc0397df798a7762a4229f0574fe5f /Makefile.am | |
| parent | b80652b1138e5abf9bdc47a66d67dae1b0ad668b (diff) | |
| download | libarchive-c9267d665c30fa78023bd70b8e9c6f02450777e2.tar.gz | |
RAR5 reader: verify window size for multivolume archives
RAR5 archives can contain files that span across multiple .rar files. If the
archive contains a big file that doesn't fit to first .rar file, then this file
is continued in another .rar file.
In this case, the RAR compressor first emits the FILE base block for this big
file in the first .rar file. Then, it finishes first .rar file, and creates the
new .rar file. In this new file, it emits the continuation FILE block that
marks start of the continuation data for the rest of the huge file.
The problem was that the RAR5 reader didn't ignore the window size declaration
when parsing through the continuation FILE base block. The malicious file could
declare a different window size inside the continuation base block than was
declared in the primary FILE base block in the previous volume. The window size
from continuation block was applied, but the actual window buffer was not
reallocated. This resulted in a potential SIGSEGV error, since bounary checks
for accessing the window buffer were working incorrectly (the window size
variable didn't match the actual window buffer size).
The commit fixes the issue by ignoring the window size declaration in the
continuation FILE base block when switching volumes.
The commit also contains a test case and OSSFuzz sample #19509.
Diffstat (limited to 'Makefile.am')
| -rw-r--r-- | Makefile.am | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am index 6d864fb6..188c9fc7 100644 --- a/Makefile.am +++ b/Makefile.am @@ -873,6 +873,7 @@ libarchive_test_EXTRA_DIST=\ libarchive/test/test_read_format_rar5_truncated_huff.rar.uu \ libarchive/test/test_read_format_rar5_win32.rar.uu \ libarchive/test/test_read_format_rar5_arm_filter_on_window_boundary.rar.uu \ + libarchive/test/test_read_format_rar5_different_winsize_on_merge.rar.uu \ libarchive/test/test_read_format_raw.bufr.uu \ libarchive/test/test_read_format_raw.data.gz.uu \ libarchive/test/test_read_format_raw.data.Z.uu \ |