浏览代码

Fix stack overflow in ZipArchiveIOSystem::MapArchive

The function allocates a filename buffer of 256, and copies the filename
extracted from the zip file into it. However, a filename might be larger
than 256 characters, in which case the function would write out of bounds.

This commit skips any file whose name is larger than 256 to avoid the
overflow.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38870
Fix #4228
Alex Rebert 3 年之前
父节点
当前提交
34d8fba100
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      code/Common/ZipArchiveIOSystem.cpp

+ 1 - 1
code/Common/ZipArchiveIOSystem.cpp

@@ -372,7 +372,7 @@ void ZipArchiveIOSystem::Implement::MapArchive() {
         unz_file_info fileInfo;
 
         if (unzGetCurrentFileInfo(m_ZipFileHandle, &fileInfo, filename, FileNameSize, nullptr, 0, nullptr, 0) == UNZ_OK) {
-            if (fileInfo.uncompressed_size != 0) {
+            if (fileInfo.uncompressed_size != 0 && fileInfo.size_filename <= FileNameSize) {
                 std::string filename_string(filename, fileInfo.size_filename);
                 SimplifyFilename(filename_string);
                 m_ArchiveMap.emplace(filename_string, ZipFileInfo(m_ZipFileHandle, fileInfo.uncompressed_size));