Explorar o código

Fix out-of-bounds read in invalid compressed X file

Turo Lamminen %!s(int64=10) %!d(string=hai) anos
pai
achega
f971b66c47
Modificáronse 1 ficheiros con 4 adicións e 0 borrados
  1. 4 0
      code/XFileParser.cpp

+ 4 - 0
code/XFileParser.cpp

@@ -214,6 +214,10 @@ XFileParser::XFileParser( const std::vector<char>& pBuffer)
 			AI_SWAP2(ofs); 
 			AI_SWAP2(ofs); 
 			P += 4;
 			P += 4;
 
 
+			if (P + ofs > End + 2) {
+				throw DeadlyImportError("X: Unexpected EOF in compressed chunk");
+			}
+
 			// push data to the stream
 			// push data to the stream
 			stream.next_in   = (Bytef*)P;
 			stream.next_in   = (Bytef*)P;
 			stream.avail_in  = ofs;
 			stream.avail_in  = ofs;