backport upstream patch to fix an out-of-bounds read

ok naddy

archivers/libarchive/Makefile

@@ -1,6 +1,7 @@
 COMMENT=	multi-format archive and compression library
 
 DISTNAME=	libarchive-3.6.0
+REVISION=	0
 SHARED_LIBS=	archive		12.0	# 19.0
 CATEGORIES=	archivers
 HOMEPAGE=	https://www.libarchive.org/

archivers/libarchive/patches/patch-libarchive_archive_read_support_format_zip_c

@@ -0,0 +1,20 @@
+From cfaa28168a07ea4a53276b63068f94fce37d6aff Mon Sep 17 00:00:00 2001
+From: Tim Kientzle <kientzle@acm.org>
+Date: Thu, 24 Mar 2022 10:35:00 +0100
+Subject: [PATCH] ZIP reader: fix possible out-of-bounds read in
+ zipx_lzma_alone_init()
+
+Fixes #1672
+
+Index: libarchive/archive_read_support_format_zip.c
+--- libarchive/archive_read_support_format_zip.c.orig
++++ libarchive/archive_read_support_format_zip.c
+@@ -1667,7 +1667,7 @@ zipx_lzma_alone_init(struct archive_read *a, struct zi
+ 	 */
+ 
+ 	/* Read magic1,magic2,lzma_params from the ZIPX stream. */
+-	if((p = __archive_read_ahead(a, 9, NULL)) == NULL) {
++	if(zip->entry_bytes_remaining < 9 || (p = __archive_read_ahead(a, 9, NULL)) == NULL) {
+ 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+ 		    "Truncated lzma data");
+ 		return (ARCHIVE_FATAL);