From 66e576525d35c68fcb86f142ebaa5a448555c0c7 Mon Sep 17 00:00:00 2001
From: Colin Percival <cperciva@FreeBSD.org>
Date: Mon, 20 Sep 2010 14:58:08 +0000
Subject: [PATCH] Fix an integer overflow in RLE length parsing when
 decompressing corrupt bzip2 data.

Approved by:	so (cperciva)
Security:	FreeBSD-SA-10:08.bzip2
---
 contrib/bzip2/decompress.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/contrib/bzip2/decompress.c b/contrib/bzip2/decompress.c
index bba5e0fa36dc..af1d4d09afb9 100644
--- a/contrib/bzip2/decompress.c
+++ b/contrib/bzip2/decompress.c
@@ -381,6 +381,13 @@ Int32 BZ2_decompress ( DState* s )
             es = -1;
             N = 1;
             do {
+               /* Check that N doesn't get too big, so that es doesn't
+                  go negative.  The maximum value that can be
+                  RUNA/RUNB encoded is equal to the block size (post
+                  the initial RLE), viz, 900k, so bounding N at 2
+                  million should guard against overflow without
+                  rejecting any legitimate inputs. */
+               if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
                if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
                if (nextSym == BZ_RUNB) es = es + (1+1) * N;
                N = N * 2;