Commit 56c18ccf for xz
commit 56c18ccfb7a707d4eba4b619e60324f84032b4fa
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Jun 16 21:48:57 2026 +0300
liblzma: file info decoder: Add an integer overflow check
After the previous commit, the overflow should be impossible, but it's
better to add the check anyway.
Fixes: https://github.com/tukaani-project/xz/pull/226
diff --git a/src/liblzma/common/file_info.c b/src/liblzma/common/file_info.c
index 4b2eb5d0..c14a2819 100644
--- a/src/liblzma/common/file_info.c
+++ b/src/liblzma/common/file_info.c
@@ -717,6 +717,13 @@ file_info_decoder_memconfig(void *coder_ptr, uint64_t *memusage,
}
}
+ // combined_index_memusage + this_index_memusage shouldn't overflow
+ // because combined_index_memusage is limited by how much can be
+ // successfully allocated, and this_index_memusage is limited by
+ // INDEX_RECORDS_MAX in index_decoder.c. Check for overflow anyway.
+ if (UINT64_MAX - combined_index_memusage < this_index_memusage)
+ return LZMA_PROG_ERROR;
+
// Now we know the total memory usage/requirement. If we had neither
// old Indexes nor a new Index, this will be zero which isn't
// acceptable as lzma_memusage() has to return non-zero on success