libdpkg: Swap deb name and member name in dpkg_ar_member_get_size()

Otherwise we might perform an out of bounds buffer read access in the
error output on bogus member sizes.

debian/changelog

@@ -5,6 +5,8 @@ dpkg (1.17.10) UNRELEASED; urgency=low
     embed libcompat inside libdpkg, as required by some external programs
     linking against the latter. Closes: #746122
   * Fix word wrapping logic in dselect. Regression introduced in dpkg 1.17.3.
+  * Fix possible out of bounds buffer read access in the error output on
+    bogus ar member sizes.
 
   [ Updated manpages translations ]
   * German (Helge Kreutzmann).

lib/dpkg/ar.c

@@ -77,7 +77,7 @@ dpkg_ar_member_get_size(const char *ar_name, struct ar_hdr *arh)
 		if (*str < '0' || *str > '9')
 			ohshit(_("invalid character '%c' in archive '%.250s' "
 			         "member '%.16s' size"),
-			       *str, arh->ar_name, ar_name);
+			       *str, ar_name, arh->ar_name);
 
 		size *= 10;
 		size += *str++ - '0';