libextractor

commit aecd4f2d77bd005e27495d1c949f7016a066d342
parent 4e38725fdcfc7c9216ecf38765a4321488b6f60c
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 11:05:04 +0200

preserve data on-stack to protect against override from subsequent read

Diffstat:
M
src/plugins/deb_extractor.c
 | 
8
+++++++-

1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/src/plugins/deb_extractor.c b/src/plugins/deb_extractor.c
@@ -480,6 +480,7 @@ EXTRACTOR_deb_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   uint64_t pos;
   int done = 0;
+  struct ObjectHeader hdrbuf;
   const struct ObjectHeader *hdr;
   uint64_t fsize;
   unsigned long long csize;
@@ -503,7 +504,12 @@ EXTRACTOR_deb_extract_method (struct EXTRACTOR_ExtractContext *ec)
     if (sizeof (struct ObjectHeader) !=
         ec->read (ec->cls, &data, sizeof (struct ObjectHeader)))
       return;
-    hdr = data;
+    /* The pointer read() returns addresses the shared memory window and
+       is only valid until the next read() or seek() slides it.
+       processControlTGZ() below does both, so take a copy of the object
+       header now instead of dereferencing it again afterwards. */
+    memcpy (&hdrbuf, data, sizeof (hdrbuf));
+    hdr = &hdrbuf;
     if (0 != strncmp (&hdr->trailer[0], "`\n", 2))
       return;
     memcpy (buf, &hdr->filesize[0], 10);