fix CVE-2022-26280

(cherry picked from commit 59b6708b86f6feab8839af6c17d1fe7a6996d3bd)

backport-CVE-2022-26280.patch

@@ -0,0 +1,28 @@
+From cfaa28168a07ea4a53276b63068f94fce37d6aff Mon Sep 17 00:00:00 2001
+From: Tim Kientzle <kientzle@acm.org>
+Date: Thu, 24 Mar 2022 10:35:00 +0100
+Subject: [PATCH] ZIP reader: fix possible out-of-bounds read in
+ zipx_lzma_alone_init()
+
+Fixes #1672
+
+Conflict:NA
+Reference:https://github.com/libarchive/libarchive/commit/cfaa28168a07ea4a53276b63068f94fce37d6aff
+---
+ libarchive/archive_read_support_format_zip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
+index 38ada70b5..9d6c900b2 100644
+--- a/libarchive/archive_read_support_format_zip.c
++++ b/libarchive/archive_read_support_format_zip.c
+@@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zip *zip)
+ 	 */
+ 
+ 	/* Read magic1,magic2,lzma_params from the ZIPX stream. */
+-	if((p = __archive_read_ahead(a, 9, NULL)) == NULL) {
++	if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) {
+ 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+ 		    "Truncated lzma data");
+ 		return (ARCHIVE_FATAL);
+

libarchive.spec

@@ -2,7 +2,7 @@
 
 Name:           libarchive
 Version:        3.5.2
-Release:        3
+Release:        4
 Summary:        Multi-format archive and compression library
 
 License:        BSD
@@ -16,6 +16,7 @@ BuildRequires:  openssl-devel libxml2-devel lz4-devel automake libzstd-devel
 Patch6000:      backport-libarchive-3.5.2-symlink-fix.patch
 Patch6001:	backport-CVE-2021-36976.patch
 Patch6002:	backport-CVE-2021-31566.patch
+Patch6003:	backport-CVE-2022-26280.patch
 
 Patch9000:	libarchive-uninitialized-value.patch
 
@@ -190,6 +191,9 @@ run_testsuite
 %{_bindir}/bsdcat
 
 %changelog
+* Mon Jul 04 2022 wangkerong <wangkerong@h-paetners.com> - 3.5.2-4
+- fix CVE-2022-26280
+
 * Sat Apr 09 2022 wangkerong <wangkerong@h-paetners.com> - 3.5.2-3
 - fix CVE-2021-36976,CVE-2021-31566,fix fuzz test