From 978a9184ec2464713d940b146cd64bc99e1ff568 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Fri, 7 Aug 2026 22:27:58 +0200 Subject: [PATCH] lz4/zstd: Always check upper bid byte limit If upstream filter provides huge amount of bytes, e.g. if archive is fully stored in memory, bidding accesses too many bytes. This could in turn overflow int return value, possibly leading to signed integer overflows. Signed-off-by: Tobias Stoeckmann --- libarchive/archive_read_support_filter_lz4.c | 6 ++---- libarchive/archive_read_support_filter_zstd.c | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/libarchive/archive_read_support_filter_lz4.c b/libarchive/archive_read_support_filter_lz4.c index 28189a07..a855f1fe 100644 --- a/libarchive/archive_read_support_filter_lz4.c +++ b/libarchive/archive_read_support_filter_lz4.c @@ -205,13 +205,11 @@ lz4_reader_bid(struct archive_read_filter_bidder *b, * if this is LZ4 data. */ if (archive_ckd_add_size(&min, - offset_in_buffer, min_lz4_frame_size)) + offset_in_buffer, min_lz4_frame_size) || + min > max_lookahead) return (0); /* TODO: should this be >= ? */ if (min > (size_t)avail) { - if (min > max_lookahead) - return (0); - buffer = __archive_read_filter_ahead(f, min, &avail); if (buffer == NULL) diff --git a/libarchive/archive_read_support_filter_zstd.c b/libarchive/archive_read_support_filter_zstd.c index 89406e38..b4df94ad 100644 --- a/libarchive/archive_read_support_filter_zstd.c +++ b/libarchive/archive_read_support_filter_zstd.c @@ -168,12 +168,10 @@ zstd_bidder_bid(struct archive_read_filter_bidder *b, * if this is zstd data. */ if (archive_ckd_add_size(&min, - offset_in_buffer, min_zstd_frame_size)) + offset_in_buffer, min_zstd_frame_size) || + min > max_lookahead) return (0); if (min > (size_t)avail) { - if (min > max_lookahead) - return (0); - buffer = __archive_read_filter_ahead(f, min, &avail); if (buffer == NULL)