diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c index 24ec3c10..449d937f 100644 --- a/src/liblzma/common/index.c +++ b/src/liblzma/common/index.c @@ -660,6 +660,12 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator, if (uncompressed_base + uncompressed_size > LZMA_VLI_MAX) return LZMA_DATA_ERROR; + // Check that the new unpadded sum will not overflow. This is + // checked again in index_file_size(), but the unpadded sum is + // passed to vli_ceil4() which expects a valid lzma_vli value. + if (compressed_base + unpadded_size > UNPADDED_SIZE_MAX) + return LZMA_DATA_ERROR; + // Check that the file size will stay within limits. if (index_file_size(s->node.compressed_base, compressed_base + unpadded_size, s->record_count + 1,