From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 From: Sergey Poznyakoff Date: Sat, 11 Feb 2023 11:57:39 +0200 Subject: [PATCH] Fix boundary checking in base-256 decoder * src/list.c (from_header): Base-256 encoding is at least 2 bytes long. Signed-off-by: Peter Korsgaard Upstream: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 --- src/list.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/list.c b/src/list.c index 9fafc425..86bcfdd1 100644 --- a/src/list.c +++ b/src/list.c @@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, where++; } } - else if (*where == '\200' /* positive base-256 */ - || *where == '\377' /* negative base-256 */) + else if (where <= lim - 2 + && (*where == '\200' /* positive base-256 */ + || *where == '\377' /* negative base-256 */)) { /* Parse base-256 output. A nonnegative number N is represented as (256**DIGS)/2 + N; a negative number -N is -- 2.39.2