svn commit: r336801 - head/contrib/libarchive/libarchive

[Conrad Meyer]

Author: cem
Date: Sat Jul 28 00:59:59 2018
New Revision: 336801
URL: https://svnweb.freebsd.org/changeset/base/336801

Log:
  MFV r336800: libarchive: Cherry-pick upstream 2c8c83b9
  
  Relevant vendor changes:
    Fix issue #948: out-of-bounds read in lha_read_data_none()
  
  admbugs:	877
  MFC after:	3 days
  Security:	CVE-2017-14503

Modified:
  head/contrib/libarchive/libarchive/archive_read_support_format_lha.c
Directory Properties:
  head/contrib/libarchive/   (props changed)

Modified: head/contrib/libarchive/libarchive/archive_read_support_format_lha.c
==============================================================================
--- head/contrib/libarchive/libarchive/archive_read_support_format_lha.c	Sat Jul 28 00:55:57 2018	(r336800)
+++ head/contrib/libarchive/libarchive/archive_read_support_format_lha.c	Sat Jul 28 00:59:59 2018	(r336801)
@@ -701,6 +701,12 @@ archive_read_format_lha_read_header(struct archive_rea
 	 * Prepare variables used to read a file content.
 	 */
 	lha->entry_bytes_remaining = lha->compsize;
+	if (lha->entry_bytes_remaining < 0) {
+		archive_set_error(&a->archive,
+		    ARCHIVE_ERRNO_FILE_FORMAT,
+		    "Invalid LHa entry size");
+		return (ARCHIVE_FATAL);
+	}
 	lha->entry_offset = 0;
 	lha->entry_crc_calculated = 0;