_nl_load_locale_from_archive() checks for a zero size, but
divides by both (size) and (size-2). Extend the check to
guard against a size of two or less.
Tested by manually corrupting locale-archive and running a program
that calls setlocale() with LOCPATH unset (size is typically very
large).
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+ head->namehash_offset);
/* Avoid division by 0 if the file is corrupted. */
- if (__glibc_unlikely (head->namehash_size == 0))
+ if (__glibc_unlikely (head->namehash_size <= 2))
goto close_and_out;
idx = hval % head->namehash_size;