Fix invalid memory write on malformed tar files
ClosedPublic

Authored by aacid on Apr 17 2019, 6:52 PM.

Details

Summary

If the file says it has a longlink of more than int_max bytes, the resize would do nothing (since casting to int means a negative number) and we'd try writing on a bytearray of size 0

Diff Detail

Repository
R243 KArchive
Branch
master
Lint
No Linters Available
Unit
No Unit Test Coverage
Build Status
Buildable 10974
Build 10992: arc lint + arc unit
aacid created this revision.Apr 17 2019, 6:52 PM
Restricted Application added a project: Frameworks. · View Herald TranscriptApr 17 2019, 6:52 PM
Restricted Application added a subscriber: kde-frameworks-devel. · View Herald Transcript
aacid requested review of this revision.Apr 17 2019, 6:52 PM
apol added a subscriber: apol.Apr 17 2019, 10:16 PM

+1 in general

src/ktar.cpp
241

It could make sense to say that it's because of the maximum size longling can have in a comment.

aacid added inline comments.Apr 17 2019, 10:23 PM
src/ktar.cpp
241

You mean also printing std::numeric_limits<int>::max() ?

apol accepted this revision.Apr 17 2019, 10:46 PM
apol added inline comments.
src/ktar.cpp
241

I meant in a comment, but yeah, it's on the warning already.

This revision is now accepted and ready to land.Apr 17 2019, 10:46 PM
aacid closed this revision.Apr 18 2019, 7:08 AM