Bug#437703: CVE-2007-3726: crafted RAR archive may cause crash

[Luciano Bello]

tags 437703 patch
stop

The adaptation attached.

luciano

--- rarvm.cpp.orig	2007-09-01 01:02:26.000000000 -0300
+++ rarvm.cpp	2007-09-01 01:08:49.000000000 -0300
@@ -843,7 +843,7 @@
         int DataSize=R[4];
         uint FileOffset=R[6];
 
-        if (DataSize>=VM_GLOBALMEMADDR)
+        if ((DataSize>=VM_GLOBALMEMADDR) || (DataSize < 4))
           break;
 
         const int FileSize=0x1000000;
@@ -889,7 +889,7 @@
         int DataSize=R[4];
         uint FileOffset=R[6];
 
-        if (DataSize>=VM_GLOBALMEMADDR)
+        if ((DataSize>=VM_GLOBALMEMADDR) || (DataSize < 21))
           break;
 
         uint CurPos=0;