diff options
| author | Daniel Axtens <dja@axtens.net> | 2018-12-04 16:33:42 +1100 |
|---|---|---|
| committer | Daniel Axtens <dja@axtens.net> | 2018-12-11 13:58:11 +1100 |
| commit | 9c84b7426660c09c18cc349f6d70b5f8168b5680 (patch) | |
| tree | 6aeee318d7d298af4520f243acaf4a9f317ec472 /libarchive/archive_read_support_format_warc.c | |
| parent | 15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175 (diff) | |
| download | libarchive-9c84b7426660c09c18cc349f6d70b5f8168b5680.tar.gz | |
warc: consume data once read
The warc decoder only used read ahead, it wouldn't actually consume
data that had previously been printed. This means that if you specify
an invalid content length, it will just reprint the same data over
and over and over again until it hits the desired length.
This means that a WARC resource with e.g.
Content-Length: 666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666665
but only a few hundred bytes of data, causes a quasi-infinite loop.
Consume data in subsequent calls to _warc_read.
Found with an AFL + afl-rb + qsym setup.
Diffstat (limited to 'libarchive/archive_read_support_format_warc.c')
| -rw-r--r-- | libarchive/archive_read_support_format_warc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libarchive/archive_read_support_format_warc.c b/libarchive/archive_read_support_format_warc.c index e8753853..e8fc8428 100644 --- a/libarchive/archive_read_support_format_warc.c +++ b/libarchive/archive_read_support_format_warc.c @@ -386,6 +386,11 @@ _warc_read(struct archive_read *a, const void **buf, size_t *bsz, int64_t *off) return (ARCHIVE_EOF); } + if (w->unconsumed) { + __archive_read_consume(a, w->unconsumed); + w->unconsumed = 0U; + } + rab = __archive_read_ahead(a, 1U, &nrd); if (nrd < 0) { *bsz = 0U; |