components/p7zip/patches/CVE-2016-2335.patch
author Petr Sumbera <petr.sumbera@oracle.com>
Thu, 19 Jan 2017 08:24:53 -0800
changeset 7600 b08206e584c3
parent 6131 10e69396d753
permissions -rw-r--r--
25422515 Upgrade Firefox to version 45.7 ESR 25445147 problem in FIREFOX/BROWSER

This patch was pulled from the p7zip forums at:

https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/1dba/attachment/CVE-2016-2335.patch

This should be part of p7zip 16, once it ships.

Index: p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
===================================================================
--- p7zip_15.14.1.orig/CPP/7zip/Archive/Udf/UdfIn.cpp
+++ p7zip_15.14.1/CPP/7zip/Archive/Udf/UdfIn.cpp
@@ -389,7 +389,11 @@ HRESULT CInArchive::ReadFileItem(int vol
     return S_FALSE;
   CFile &file = Files.Back();
   const CLogVol &vol = LogVols[volIndex];
-  CPartition &partition = Partitions[vol.PartitionMaps[lad.Location.PartitionRef].PartitionIndex];
+  unsigned partitionRef = lad.Location.PartitionRef;
+
+  if (partitionRef >= vol.PartitionMaps.Size())
+  	return S_FALSE;
+  CPartition &partition = Partitions[vol.PartitionMaps[partitionRef].PartitionIndex];
 
   UInt32 key = lad.Location.Pos;
   UInt32 value;