defensive programming: avoid malloc(0) in deb extractor

2 files changed, 4 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index f6dd28e..c2a27af 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 Sun Oct 15 19:36:41 CEST 2017
         Fix potential file descriptor leak (on error handling path).
         Fix potential assign-after-free (on IPC error handling path).
-        Make sure to only pass "unsigned char" to functions like isspace(). -CG
+        Make sure to only pass "unsigned char" to functions like isspace().
+        Avoid malloc(0) in DEB extractor under certain conditions. -CG
 
 Fri Oct 13 12:30:37 CEST 2017
         Properly check read error in NSF plugin (from signedness confusion) found by Leon Zhao. -CG
diff --git a/src/plugins/deb_extractor.c b/src/plugins/deb_extractor.c
index 4716732..afbe8bb 100644
--- a/src/plugins/deb_extractor.c
+++ b/src/plugins/deb_extractor.c
@@ -363,6 +363,8 @@ processControlTGZ (struct EXTRACTOR_ExtractContext *ec,
 
   if (size > MAX_CONTROL_SIZE)
     return 0;
+  if (0 == size)
+    return 0;
   if (NULL == (cdata = malloc (size)))
     return 0;
   off = 0;