libarchive/contribs9/libarchive-2.8.3-CVE-2016-4809.patch

From 54b3d0b00a77476874ab8eb01263d75227607eeb Mon Sep 17 00:00:00 2001
From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 14 May 2016 12:37:37 -0700
Subject: [PATCH] Reject cpio symlinks that exceed 1MB

---
 libarchive/archive_read_support_format_cpio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libarchive/archive_read_support_format_cpio.c b/libarchive/archive_read_support_format_cpio.c
index 1def000..37d8caf 100644
--- a/libarchive/archive_read_support_format_cpio.c
+++ b/libarchive/archive_read_support_format_cpio.c
@@ -247,6 +247,11 @@ archive_read_format_cpio_read_header(struct archive_read *a,
 
        /* If this is a symlink, read the link contents. */
        if (archive_entry_filetype(entry) == AE_IFLNK) {
+               if (cpio->entry_bytes_remaining > 1024 * 1024) {
+                       archive_set_error(&a->archive, ENOMEM,
+                           "Rejecting malformed cpio archive: symlink contents exceed 1 megabyte");
+                       return (ARCHIVE_FATAL);
+               }
                h = __archive_read_ahead(a, cpio->entry_bytes_remaining, NULL);
                if (h == NULL)
                        return (ARCHIVE_FATAL);
-- 
2.7.4

1	jpp	1.1	From 54b3d0b00a77476874ab8eb01263d75227607eeb Mon Sep 17 00:00:00 2001
2			From: Tim Kientzle <kientzle@acm.org>
3			Date: Sat, 14 May 2016 12:37:37 -0700
4			Subject: [PATCH] Reject cpio symlinks that exceed 1MB
5
6			---
7			libarchive/archive_read_support_format_cpio.c \| 5 +++++
8			1 file changed, 5 insertions(+)
9
10			diff --git a/libarchive/archive_read_support_format_cpio.c b/libarchive/archive_read_support_format_cpio.c
11			index 1def000..37d8caf 100644
12			--- a/libarchive/archive_read_support_format_cpio.c
13			+++ b/libarchive/archive_read_support_format_cpio.c
14			@@ -247,6 +247,11 @@ archive_read_format_cpio_read_header(struct archive_read *a,
15
16			/* If this is a symlink, read the link contents. */
17			if (archive_entry_filetype(entry) == AE_IFLNK) {
18			+ if (cpio->entry_bytes_remaining > 1024 * 1024) {
19			+ archive_set_error(&a->archive, ENOMEM,
20			+ "Rejecting malformed cpio archive: symlink contents exceed 1 megabyte");
21			+ return (ARCHIVE_FATAL);
22			+ }
23			h = __archive_read_ahead(a, cpio->entry_bytes_remaining, NULL);
24			if (h == NULL)
25			return (ARCHIVE_FATAL);
26			--
27			2.7.4
28