--- unrar-nonfree-5.3.2.org/rarvm.cpp
+++ unrar-nonfree-5.3.2/rarvm.cpp
@@ -965,7 +965,7 @@
       {
         int DataSize=R[4],Channels=R[0],SrcPos=0,Border=DataSize*2;
         SET_VALUE(false,&Mem[VM_GLOBALMEMADDR+0x20],DataSize);
-        if ((uint)DataSize>=VM_GLOBALMEMADDR/2)
+        if ((uint)DataSize>=VM_GLOBALMEMADDR/2 || (uint)Channels>MAX3_UNPACK_CHANNELS || Channels==0)
           break;
 
         // Bytes from same channels are grouped to continual data blocks,
@@ -984,7 +984,7 @@
         byte *SrcData=Mem,*DestData=SrcData+DataSize;
         const int Channels=3;
         SET_VALUE(false,&Mem[VM_GLOBALMEMADDR+0x20],DataSize);
-        if ((uint)DataSize>=VM_GLOBALMEMADDR/2 || Width<0 || PosR<0)
+        if ((uint)DataSize>=VM_GLOBALMEMADDR/2 || Width<0 || PosR<0 || DataSize<3 || Width>DataSize || PosR>2)
           break;
         for (int CurChannel=0;CurChannel<Channels;CurChannel++)
         {
@@ -1029,7 +1029,7 @@
         int DataSize=R[4],Channels=R[0];
         byte *SrcData=Mem,*DestData=SrcData+DataSize;
         SET_VALUE(false,&Mem[VM_GLOBALMEMADDR+0x20],DataSize);
-        if ((uint)DataSize>=VM_GLOBALMEMADDR/2)
+        if ((uint)DataSize>=VM_GLOBALMEMADDR/2 || (uint)Channels>128 || Channels==0)
           break;
         for (int CurChannel=0;CurChannel<Channels;CurChannel++)
         {
--- unrar-nonfree-5.3.2.orig/unpack.hpp
+++ unrar-nonfree-5.3.2/unpack.hpp
@@ -13,6 +13,12 @@
 // from two data blocks.
 #define MAX3_UNPACK_FILTERS      8192
 
+// Limit maximum number of channels in RAR3 delta filter to some reasonable
+// value to prevent too slow processing of corrupt archives with invalid
+// channels number. Must be equal or larger than v3_MAX_FILTER_CHANNELS.
+// No need to provide it for RAR5, which uses only 5 bits to store channels.
+#define MAX3_UNPACK_CHANNELS      1024
+
 // Write data in 4 MB or smaller blocks. Must not exceed PACK_MAX_WRITE,
 // so we keep number of buffered filter in unpacker reasonable.
 #define UNPACK_MAX_WRITE     0x400000
