diff options
| author | kientzle <kientzle@FreeBSD.org> | 2007-04-02 00:25:11 +0000 |
|---|---|---|
| committer | kientzle <kientzle@FreeBSD.org> | 2007-04-02 00:25:11 +0000 |
| commit | 214dcbe28a9870d31c06067e36d0021f9af12375 (patch) | |
| tree | 335957293c7b4a29321ad3b8bdbd9e26abc39701 | |
| parent | fce578bdb853a07ca2353a37e315414ecf3b75dc (diff) | |
| download | FreeBSD-src-214dcbe28a9870d31c06067e36d0021f9af12375.zip FreeBSD-src-214dcbe28a9870d31c06067e36d0021f9af12375.tar.gz | |
Avoid a potential overflow when 'skip' is larger than a pointer.
Thanks to: Joerg Sonnenberger
| -rw-r--r-- | lib/libarchive/archive_read_open_memory.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libarchive/archive_read_open_memory.c b/lib/libarchive/archive_read_open_memory.c index e87ef78..b32a6f3 100644 --- a/lib/libarchive/archive_read_open_memory.c +++ b/lib/libarchive/archive_read_open_memory.c @@ -134,7 +134,7 @@ memory_read_skip(struct archive *a, void *client_data, off_t skip) struct read_memory_data *mine = (struct read_memory_data *)client_data; (void)a; /* UNUSED */ - if (mine->buffer + skip > mine->end) + if (skip > mine->end - mine->buffer) skip = mine->end - mine->buffer; /* Round down to block size. */ skip /= mine->read_size; |
