tarfs: Avoid overflow in exthdr calculation.

MFC after:	3 days
PR:		277420
Sponsored by:	Juniper Networks, Inc.
Sponsored by:	Klara, Inc.
Reviewed by:	kib
Differential Revision:	https://reviews.freebsd.org/D44202
This commit is contained in:
Dag-Erling Smørgrav 2024-03-06 17:13:54 +01:00
parent 8427d94ce0
commit c291b7914e

View file

@ -583,7 +583,8 @@ again:
error = EINVAL;
goto bad;
}
if (line + len > exthdr + sz) {
if ((uintptr_t)line + len < (uintptr_t)line ||
line + len > exthdr + sz) {
TARFS_DPF(ALLOC, "%s: exthdr overflow\n",
__func__);
error = EINVAL;