rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
Vulnerability ID: CVE-2017-2669
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/dovecot/core
Published: 2018-06-21
File: src/auth/db-dict.c
Commit message: auth: Do not double-expand key in passdb dict when authenticating

Broken by 79042f8c
Commit author: Aki Tuomi

Vulnerable version (before fix):
 static int db_dict_iter_lookup_key_values(struct db_dict_value_iter *iter) 			continue;  		str_truncate(path, strlen(DICT_PATH_SHARED)); 		ret = var_expand(path, key->key->key, iter->var_expand_table, &error); 		if (ret <= 0) { 			auth_request_log_error(iter->auth_request, AUTH_SUBSYS_DB, 				"Failed to expand key %s: %s", key->key->key, error); 			return -1; 		} 		ret = dict_lookup(iter->conn->dict, iter->pool, 				  str_c(path), &key->value, &error); 		if (ret > 0) {

Fixed version (after fix):
 static int db_dict_iter_lookup_key_values(struct db_dict_value_iter *iter) 			continue;  		str_truncate(path, strlen(DICT_PATH_SHARED)); 		str_append(path, key->key->key); 		ret = dict_lookup(iter->conn->dict, iter->pool, 				  str_c(path), &key->value, &error); 		if (ret > 0) {

Patch:
patch: @@ -413,12 +413,7 @@ static int db_dict_iter_lookup_key_values(struct db_dict_value_iter *iter)
 			continue;
 
 		str_truncate(path, strlen(DICT_PATH_SHARED));
-		ret = var_expand(path, key->key->key, iter->var_expand_table, &error);
-		if (ret <= 0) {
-			auth_request_log_error(iter->auth_request, AUTH_SUBSYS_DB,
-				"Failed to expand key %s: %s", key->key->key, error);
-			return -1;
-		}
+		str_append(path, key->key->key);
 		ret = dict_lookup(iter->conn->dict, iter->pool,
 				  str_c(path), &key->value, &error);
 		if (ret > 0) {
path: src/auth/db-dict.c
Vulnerability: In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Vulnerability ID: CVE-2017-3730
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/openssl/openssl
Published: 2017-05-04
File: ssl/statem/statem_clnt.c
Commit message: Fix missing NULL checks in CKE processing

Reviewed-by: Rich Salz <rsalz@openssl.org>
Commit author: Matt Caswell

Vulnerable version (before fix):
 static int tls_construct_cke_dhe(SSL *s, unsigned char **p, int *len, int *al)         return 0;     }     ckey = ssl_generate_pkey(skey);     dh_clnt = EVP_PKEY_get0_DH(ckey);      if (dh_clnt == NULL || ssl_derive(s, ckey, skey) == 0) { static int tls_construct_cke_ecdhe(SSL *s, unsigned char **p, int *len, int *al)     }      ckey = ssl_generate_pkey(skey);      if (ssl_derive(s, ckey, skey) == 0) {         SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EVP_LIB);

Fixed version (after fix):
 static int tls_construct_cke_dhe(SSL *s, unsigned char **p, int *len, int *al)         return 0;     }     ckey = ssl_generate_pkey(skey);     if (ckey == NULL) {         SSLerr(SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR);         return 0;     }      dh_clnt = EVP_PKEY_get0_DH(ckey);      if (dh_clnt == NULL || ssl_derive(s, ckey, skey) == 0) { static int tls_construct_cke_ecdhe(SSL *s, unsigned char **p, int *len, int *al)     }      ckey = ssl_generate_pkey(skey);     if (ckey == NULL) {         SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR);         goto err;     }      if (ssl_derive(s, ckey, skey) == 0) {         SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EVP_LIB);

Patch:
patch: @@ -2258,6 +2258,11 @@ static int tls_construct_cke_dhe(SSL *s, unsigned char **p, int *len, int *al)
         return 0;
     }
     ckey = ssl_generate_pkey(skey);
+    if (ckey == NULL) {
+        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR);
+        return 0;
+    }
+
     dh_clnt = EVP_PKEY_get0_DH(ckey);
 
     if (dh_clnt == NULL || ssl_derive(s, ckey, skey) == 0) {
@@ -2296,6 +2301,10 @@ static int tls_construct_cke_ecdhe(SSL *s, unsigned char **p, int *len, int *al)
     }
 
     ckey = ssl_generate_pkey(skey);
+    if (ckey == NULL) {
+        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
 
     if (ssl_derive(s, ckey, skey) == 0) {
         SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EVP_LIB);
path: ssl/statem/statem_clnt.c
Vulnerability: While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Vulnerability ID: CVE-2017-3735
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/openssl/openssl
Published: 2017-08-28
File: crypto/x509v3/v3_addr.c
Commit message: Avoid out-of-bounds read

Fixes CVE 2017-3735

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4276)

(cherry picked from commit b23171744b01e473ebbfd6edad70c1c3825ffbcd)
Commit author: Rich Salz

Vulnerable version (before fix):
 static int length_from_afi(const unsigned afi)  */ unsigned int X509v3_addr_get_afi(const IPAddressFamily *f) {     return ((f != NULL &&              f->addressFamily != NULL && f->addressFamily->data != NULL)             ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))             : 0); }  /*

Fixed version (after fix):
 static int length_from_afi(const unsigned afi)  */ unsigned int X509v3_addr_get_afi(const IPAddressFamily *f) {     if (f == NULL             || f->addressFamily == NULL             || f->addressFamily->data == NULL             || f->addressFamily->length < 2)         return 0;     return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1]; }  /*

Patch:
patch: @@ -84,10 +84,12 @@ static int length_from_afi(const unsigned afi)
  */
 unsigned int X509v3_addr_get_afi(const IPAddressFamily *f)
 {
-    return ((f != NULL &&
-             f->addressFamily != NULL && f->addressFamily->data != NULL)
-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
-            : 0);
+    if (f == NULL
+            || f->addressFamily == NULL
+            || f->addressFamily->data == NULL
+            || f->addressFamily->length < 2)
+        return 0;
+    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
 }
 
 /*
path: crypto/x509v3/v3_addr.c
Vulnerability: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Vulnerability ID: CVE-2017-5226
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/projectatomic/bubblewrap
Published: 2017-03-29
File: bubblewrap.c
Commit message: Call setsid() before executing sandboxed code (CVE-2017-5226)

This prevents the sandboxed code from getting a controlling tty,
which in turn prevents it from accessing the TIOCSTI ioctl and hence
faking terminal input.

Fixes: #142

Closes: #143
Approved by: cgwalters
Commit author: Simon McVittie

Vulnerable version (before fix):
 main (int    argc,   /* We want sigchild in the child */   unblock_sigchild ();    if (label_exec (opt_exec_label) == -1)     die_with_error ("label_exec %s", argv[0]); 

Fixed version (after fix):
 main (int    argc,   /* We want sigchild in the child */   unblock_sigchild ();    if (setsid () == (pid_t) -1)     die_with_error ("setsid");    if (label_exec (opt_exec_label) == -1)     die_with_error ("label_exec %s", argv[0]); 

Patch:
patch: @@ -2071,6 +2071,9 @@ main (int    argc,
   /* We want sigchild in the child */
   unblock_sigchild ();
 
+  if (setsid () == (pid_t) -1)
+    die_with_error ("setsid");
+
   if (label_exec (opt_exec_label) == -1)
     die_with_error ("label_exec %s", argv[0]);
path: bubblewrap.c
Vulnerability: Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
Vulnerability ID: CVE-2017-5340
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2017-01-11
File: Zend/zend_hash.c
Commit message: Fix #73832 - leave the table in a safe state if the size is too big.
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_ 	GC_REFCOUNT(ht) = 1; 	GC_TYPE_INFO(ht) = IS_ARRAY; 	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS; 	ht->nTableSize = zend_hash_check_size(nSize); 	ht->nTableMask = HT_MIN_MASK; 	HT_SET_DATA_ADDR(ht, &uninitialized_bucket); 	ht->nNumUsed = 0; 	ht->nNumOfElements = 0; 	ht->nInternalPointer = HT_INVALID_IDX; 	ht->nNextFreeElement = 0; 	ht->pDestructor = pDestructor; }  static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)

Fixed version (after fix):
 ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_ 	GC_REFCOUNT(ht) = 1; 	GC_TYPE_INFO(ht) = IS_ARRAY; 	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS; 	ht->nTableMask = HT_MIN_MASK; 	HT_SET_DATA_ADDR(ht, &uninitialized_bucket); 	ht->nNumUsed = 0; 	ht->nNumOfElements = 0; 	ht->nInternalPointer = HT_INVALID_IDX; 	ht->nNextFreeElement = 0; 	ht->pDestructor = pDestructor; 	ht->nTableSize = zend_hash_check_size(nSize); }  static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)

Patch:
patch: @@ -175,14 +175,14 @@ ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_
 	GC_REFCOUNT(ht) = 1;
 	GC_TYPE_INFO(ht) = IS_ARRAY;
 	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
-	ht->nTableSize = zend_hash_check_size(nSize);
 	ht->nTableMask = HT_MIN_MASK;
 	HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 	ht->nNumUsed = 0;
 	ht->nNumOfElements = 0;
 	ht->nInternalPointer = HT_INVALID_IDX;
 	ht->nNextFreeElement = 0;
 	ht->pDestructor = pDestructor;
+	ht->nTableSize = zend_hash_check_size(nSize);
 }
 
 static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
path: Zend/zend_hash.c
Vulnerability: Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
Vulnerability ID: CVE-2017-5480
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/b2evolution/b2evolution
Published: 2017-01-15
File: inc/files/files.ctrl.php
Commit message: Fixed fm_selected parameter exploit
Commit author: Erwin Rommel H. Satingin

Vulnerable version (before fix):
  * @global Filelist  */ $selected_Filelist = new Filelist( $fm_FileRoot, $ads_list_path ); foreach( $fm_selected as $l_source_path ) { 	$selected_Filelist->add_by_subpath( urldecode($l_source_path), true ); } 

Fixed version (after fix):
  * @global Filelist  */ $selected_Filelist = new Filelist( $fm_FileRoot, $ads_list_path );  // Prevent directory traversal using '..' $re = '/\/?\.\.\/+/'; foreach( $fm_selected as $l_source_path ) { 	if( preg_match( $re, $l_source_path ) ) 	{ 		debug_die( 'Invalid fm_selected parameter value' ); 	} 	$selected_Filelist->add_by_subpath( urldecode($l_source_path), true ); } 

Patch:
patch: @@ -343,8 +343,15 @@
  * @global Filelist
  */
 $selected_Filelist = new Filelist( $fm_FileRoot, $ads_list_path );
+
+// Prevent directory traversal using '..'
+$re = '/\/?\.\.\/+/';
 foreach( $fm_selected as $l_source_path )
 {
+	if( preg_match( $re, $l_source_path ) )
+	{
+		debug_die( 'Invalid fm_selected parameter value' );
+	}
 	$selected_Filelist->add_by_subpath( urldecode($l_source_path), true );
 }
path: inc/files/files.ctrl.php
Vulnerability: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
Vulnerability ID: CVE-2017-5506
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-24
File: MagickCore/profile.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/354
Commit author: Cristy

Vulnerable version (before fix):
 MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)             The directory entry contains an offset.           */           offset=(ssize_t)  ReadProfileLong(endian,q+8);           if ((size_t) (offset+number_bytes) > length)             continue;           if (~length < number_bytes)             continue;  /* prevent overflow */

Fixed version (after fix):
 MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)             The directory entry contains an offset.           */           offset=(ssize_t)  ReadProfileLong(endian,q+8);           if ((offset < 0) || ((size_t) (offset+number_bytes) > length))             continue;           if (~length < number_bytes)             continue;  /* prevent overflow */

Patch:
patch: @@ -2043,7 +2043,7 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
             The directory entry contains an offset.
           */
           offset=(ssize_t)  ReadProfileLong(endian,q+8);
-          if ((size_t) (offset+number_bytes) > length)
+          if ((offset < 0) || ((size_t) (offset+number_bytes) > length))
             continue;
           if (~length < number_bytes)
             continue;  /* prevent overflow */
path: MagickCore/profile.c
Vulnerability: The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Vulnerability ID: CVE-2017-5545
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/libimobiledevice/libplist
Published: 2017-01-21
File: tools/plistutil.c
Commit message: plistutil: Prevent OOB heap buffer read by checking input size

As pointed out in #87 plistutil would do a memcmp with a heap buffer
without checking the size. If the size is less than 8 it would read
beyond the bounds of this heap buffer. This commit prevents that.
Commit author: Nikias Bassen

Vulnerable version (before fix):
 int main(int argc, char *argv[])     }      stat(options->in_file, &filestats);     plist_entire = (char *) malloc(sizeof(char) * (filestats.st_size + 1));     read_size = fread(plist_entire, sizeof(char), filestats.st_size, iplist);     fclose(iplist);

Fixed version (after fix):
 int main(int argc, char *argv[])     }      stat(options->in_file, &filestats);      if (filestats.st_size < 8) {         printf("ERROR: Input file is too small to contain valid plist data.\n");         return -1;     }      plist_entire = (char *) malloc(sizeof(char) * (filestats.st_size + 1));     read_size = fread(plist_entire, sizeof(char), filestats.st_size, iplist);     fclose(iplist);

Patch:
patch: @@ -129,6 +129,12 @@ int main(int argc, char *argv[])
     }
 
     stat(options->in_file, &filestats);
+
+    if (filestats.st_size < 8) {
+        printf("ERROR: Input file is too small to contain valid plist data.\n");
+        return -1;
+    }
+
     plist_entire = (char *) malloc(sizeof(char) * (filestats.st_size + 1));
     read_size = fread(plist_entire, sizeof(char), filestats.st_size, iplist);
     fclose(iplist);
path: tools/plistutil.c
Vulnerability: Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call.
Vulnerability ID: CVE-2017-5576
CWE: CWE-190
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-06
File: drivers/gpu/drm/vc4/vc4_gem.c
Commit message: drm/vc4: Fix an integer overflow in temporary allocation layout.

We copy the unvalidated ioctl arguments from the user into kernel
temporary memory to run the validation from, to avoid a race where the
user updates the unvalidate contents in between validating them and
copying them into the validated BO.

However, in setting up the layout of the kernel side, we failed to
check one of the additions (the roundup() for shader_rec_offset)
against integer overflow, allowing a nearly MAX_UINT value of
bin_cl_size to cause us to under-allocate the temporary space that we
then copy_from_user into.

Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
Commit author: Eric Anholt

Vulnerable version (before fix):
 vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) 					  args->shader_rec_count); 	struct vc4_bo *bo;  	if (uniforms_offset < shader_rec_offset || 	    exec_size < uniforms_offset || 	    args->shader_rec_count >= (UINT_MAX / 					  sizeof(struct vc4_shader_state)) ||

Fixed version (after fix):
 vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) 					  args->shader_rec_count); 	struct vc4_bo *bo;  	if (shader_rec_offset < args->bin_cl_size || 	    uniforms_offset < shader_rec_offset || 	    exec_size < uniforms_offset || 	    args->shader_rec_count >= (UINT_MAX / 					  sizeof(struct vc4_shader_state)) ||

Patch:
patch: @@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
 					  args->shader_rec_count);
 	struct vc4_bo *bo;
 
-	if (uniforms_offset < shader_rec_offset ||
+	if (shader_rec_offset < args->bin_cl_size ||
+	    uniforms_offset < shader_rec_offset ||
 	    exec_size < uniforms_offset ||
 	    args->shader_rec_count >= (UINT_MAX /
 					  sizeof(struct vc4_shader_state)) ||
path: drivers/gpu/drm/vc4/vc4_gem.c
Vulnerability: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
Vulnerability ID: CVE-2017-5589
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/ge0rg/yaxim
Published: 2017-02-09
File: src/org/yaxim/androidclient/service/SmackableImp.java
Commit message: Smackable: improved carbon checks
Commit author: Georg Lukas

Vulnerable version (before fix):
 public void processPacket(Packet packet) { 					 					int direction = ChatConstants.INCOMING; 					Carbon cc = CarbonManager.getCarbon(msg);  					// extract timestamp 					long ts;

Fixed version (after fix):
 public void processPacket(Packet packet) { 					 					int direction = ChatConstants.INCOMING; 					Carbon cc = CarbonManager.getCarbon(msg); 					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) { 						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML()); 						cc = null; 					}  					// extract timestamp 					long ts;

Patch:
patch: @@ -1242,6 +1242,10 @@ public void processPacket(Packet packet) {
 					
 					int direction = ChatConstants.INCOMING;
 					Carbon cc = CarbonManager.getCarbon(msg);
+					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
+						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
+						cc = null;
+					}
 
 					// extract timestamp
 					long ts;
path: src/org/yaxim/androidclient/service/SmackableImp.java
Vulnerability: An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.
Vulnerability ID: CVE-2017-5601
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2017-01-27
File: libarchive/archive_read_support_format_lha.c
Commit message: Fail with negative lha->compsize in lha_read_file_header_1()
Fixes a heap buffer overflow reported in Secunia SA74169
Commit author: Martin Matuska

Vulnerable version (before fix):
 lha_read_file_header_1(struct archive_read *a, struct lha *lha) 	/* Get a real compressed file size. */ 	lha->compsize -= extdsize - 2;  	if (sum_calculated != headersum) { 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, 		    "LHa header sum error");

Fixed version (after fix):
 lha_read_file_header_1(struct archive_read *a, struct lha *lha) 	/* Get a real compressed file size. */ 	lha->compsize -= extdsize - 2;  	if (lha->compsize < 0) 		goto invalid;	/* Invalid compressed file size */  	if (sum_calculated != headersum) { 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, 		    "LHa header sum error");

Patch:
patch: @@ -924,6 +924,9 @@ lha_read_file_header_1(struct archive_read *a, struct lha *lha)
 	/* Get a real compressed file size. */
 	lha->compsize -= extdsize - 2;
 
+	if (lha->compsize < 0)
+		goto invalid;	/* Invalid compressed file size */
+
 	if (sum_calculated != headersum) {
 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
 		    "LHa header sum error");
path: libarchive/archive_read_support_format_lha.c