root/xz
1
0
Fork 0
mirror of https://git.tukaani.org/xz.git synced 2026-10-31 11:24:56 +00:00
Code Issues Releases Wiki Activity

liblzma: Fix input_size_max in lzma_index_buffer_decode()

Browse Source 
If *in_pos > 0, the condition became more relaxed than it needed to be.

Fixes: 5005914f1acf ("liblzma: Index decoder: Reject an obviously-bad Number of>
Fixes: 0352dc7929b1 ("liblzma: Silence a compiler warning")
This commit is contained in:
Lasse Collin 2026-07-21 12:58:45 +03:00
parent d4edae32b6
commit 0877609467
No known key found for this signature in database
GPG Key ID: 38EE757D69184620
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/liblzma/common/index_decoder.c
View File

@ -367,11 +367,10 @@ lzma_index_buffer_decode(lzma_index **i, uint64_t *memlimit,
return LZMA_PROG_ERROR; return LZMA_PROG_ERROR;
// Initialize the decoder. // Initialize the decoder.
// in_size64 is to silence gcc -Wtype-limits on 32-bit targets.
lzma_index_coder coder; lzma_index_coder coder;
const uint64_t in_size64 = in_size; const uint64_t input_size_max = in_size - *in_pos;
return_if_error(index_decoder_reset(&coder, allocator, i, *memlimit, return_if_error(index_decoder_reset(&coder, allocator, i, *memlimit,
my_min(in_size64, LZMA_BACKWARD_SIZE_MAX))); my_min(input_size_max, LZMA_BACKWARD_SIZE_MAX)));
// Store the input start position so that we can restore it in case // Store the input start position so that we can restore it in case
// of an error. // of an error.