Bookkeeping errors when extending the read-ahead buffer when trying to identify an mtree archive could lead libarchive to significantly overcalculate the size of the line being read, resulting in heap out-of-bounds reads or a crash.

Disclosed on oss-security:

http://seclists.org/oss-sec/2016/q3/516

Upstream issue:

https://github.com/libarchive/libarchive/issues/747

Upstream fix:

https://github.com/libarchive/libarchive/commit/eec077f

All the mtree-related crashes in the oss-sec post came from the same underlying issue and were resolved in this commit.

libarchive. A buffer overflow issue was addressed through improved memory handling.

A crafted 7zip archive with multiple headers of the same kind could cause calculated values from one being used to interpret the other, leading to out-of-bounds reads of adjacent structures on the heap.

Disclosed on oss-security:

http://seclists.org/oss-sec/2016/q3/516

Upstream issue:

https://github.com/libarchive/libarchive/issues/761

Upstream fix:

https://github.com/libarchive/libarchive/commit/7f17c79