From 56c18ccfb7a707d4eba4b619e60324f84032b4fa Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Tue, 16 Jun 2026 21:48:57 +0300 Subject: [PATCH] liblzma: file info decoder: Add an integer overflow check After the previous commit, the overflow should be impossible, but it's better to add the check anyway. Fixes: https://github.com/tukaani-project/xz/pull/226 --- src/liblzma/common/file_info.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/liblzma/common/file_info.c b/src/liblzma/common/file_info.c index 4b2eb5d0..c14a2819 100644 --- a/src/liblzma/common/file_info.c +++ b/src/liblzma/common/file_info.c @@ -717,6 +717,13 @@ file_info_decoder_memconfig(void *coder_ptr, uint64_t *memusage, } } + // combined_index_memusage + this_index_memusage shouldn't overflow + // because combined_index_memusage is limited by how much can be + // successfully allocated, and this_index_memusage is limited by + // INDEX_RECORDS_MAX in index_decoder.c. Check for overflow anyway. + if (UINT64_MAX - combined_index_memusage < this_index_memusage) + return LZMA_PROG_ERROR; + // Now we know the total memory usage/requirement. If we had neither // old Indexes nor a new Index, this will be zero which isn't // acceptable as lzma_memusage() has to return non-zero on success