root/xz
1
0
Fork 0
mirror of https://git.tukaani.org/xz.git synced 2026-10-31 03:14:56 +00:00
Code Issues Releases Wiki Activity

liblzma: Fix a theoretical integer overflow in lzma_index_cat()

Browse Source 
To trigger it, one would need to successfully allocate hundreds of
gigabytes of memory.
This commit is contained in:
Lasse Collin 2026-08-09 16:11:13 +03:00
parent 1a4a4df366
commit c8b8ab2ef1
No known key found for this signature in database
GPG Key ID: 38EE757D69184620
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/liblzma/common/index.c
View File

@ -807,6 +807,11 @@ lzma_index_cat(lzma_index *restrict dest, lzma_index *restrict src,
if (dest == NULL || src == NULL) if (dest == NULL || src == NULL)
return LZMA_PROG_ERROR; return LZMA_PROG_ERROR;
// Check that we don't exceed the maximum number of Streams
// per lzma_index.
if (STREAMS_MAX - dest->streams.count < src->streams.count)
return LZMA_DATA_ERROR;
const lzma_vli dest_file_size = lzma_index_file_size(dest); const lzma_vli dest_file_size = lzma_index_file_size(dest);
// Check that we don't exceed the file size limits. // Check that we don't exceed the file size limits.