Skip to content
Permalink
Browse files

fixing potential OOB window write when unpacking chm files

  • Loading branch information...
m-sola committed Mar 29, 2017
1 parent 7e83eea commit a83773682e856ad6529ba6db8d1792e6d515d7f1
Showing with 14 additions and 3 deletions.
  1. +9 −2 libclamav/libmspack-0.5alpha/mspack/lzxd.c
  2. +5 −1 libclamav/libmspack.c
@@ -766,8 +766,13 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
case LZX_BLOCKTYPE_UNCOMPRESSED:
/* as this_run is limited not to wrap a frame, this also means it
* won't wrap the window (as the window is a multiple of 32k) */
if (window_posn + this_run > lzx->window_size) {
D(("match ran over window boundary"))
return lzx->error = MSPACK_ERR_DECRUNCH;
}
rundest = &window[window_posn];
window_posn += this_run;

while (this_run > 0) {
if ((i = i_end - i_ptr) == 0) {
READ_IF_NEEDED;
@@ -888,8 +893,10 @@ void lzxd_free(struct lzxd_stream *lzx) {
struct mspack_system *sys;
if (lzx) {
sys = lzx->sys;
sys->free(lzx->inbuf);
sys->free(lzx->window);
if(lzx->inbuf)
sys->free(lzx->inbuf);
if(lzx->window)
sys->free(lzx->window);
sys->free(lzx);
}
}
@@ -264,7 +264,11 @@ static void *mspack_fmap_alloc(struct mspack_system *self, size_t num)

static void mspack_fmap_free(void *mem)
{
free(mem);
if(mem) {
free(mem);
mem = NULL;
}
return;
}

static void mspack_fmap_copy(void *src, void *dst, size_t num)

0 comments on commit a837736

Please sign in to comment.
You can’t perform that action at this time.