From 51b4c35bb38b7df4af24de7f103863dd79129b01 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Tue, 27 May 2025 17:09:12 +0200 Subject: [PATCH] Fix FILE_skip regression The fseek* family of functions return 0 on success, not the new offset. This is only true for lseek. Fixes https://github.com/libarchive/libarchive/issues/2641 Fixes dcbf1e0ededa95849f098d154a25876ed5754bcf Signed-off-by: Tobias Stoeckmann CVE: CVE-2025-5918 Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/51b4c35bb38b7df4af24de7f103863dd79129b01] Signed-off-by: Peter Marko --- libarchive/archive_read_open_file.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libarchive/archive_read_open_file.c b/libarchive/archive_read_open_file.c index 6ed18a0c..742923ab 100644 --- a/libarchive/archive_read_open_file.c +++ b/libarchive/archive_read_open_file.c @@ -132,7 +132,7 @@ FILE_skip(struct archive *a, void *client_data, int64_t request) #else long skip = (long)request; #endif - int64_t old_offset, new_offset; + int64_t old_offset, new_offset = -1; int skip_bits = sizeof(skip) * 8 - 1; (void)a; /* UNUSED */ @@ -170,11 +170,14 @@ FILE_skip(struct archive *a, void *client_data, int64_t request) #ifdef __ANDROID__ new_offset = lseek(fileno(mine->f), skip, SEEK_CUR); #elif HAVE__FSEEKI64 - new_offset = _fseeki64(mine->f, skip, SEEK_CUR); + if (_fseeki64(mine->f, skip, SEEK_CUR) == 0) + new_offset = _ftelli64(mine->f); #elif HAVE_FSEEKO - new_offset = fseeko(mine->f, skip, SEEK_CUR); + if (fseeko(mine->f, skip, SEEK_CUR) == 0) + new_offset = ftello(mine->f); #else - new_offset = fseek(mine->f, skip, SEEK_CUR); + if (fseek(mine->f, skip, SEEK_CUR) == 0) + new_offset = ftell(mine->f); #endif if (new_offset >= 0) return (new_offset - old_offset);