Commit 2c91aa7
authored
Fix benign 1-byte buffer over-write in OLE2 parser
The office art structure for OLE2 documents records the file name
length using a `uint8_t`, meaning the name may be up to 255 bytes in
length, not including the null terminating byte. If the length is
255 then the parser will write the null-terminating byte just after
the end of the name buffer on the stack.
This issue does not cause a crash and is not a vulnerability.
This fix extends the size of stack array to account for the null
terminator.
Thank you Michał Dardas for reporting this issue.1 parent d209051 commit 2c91aa7
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4441 | 4441 | | |
4442 | 4442 | | |
4443 | 4443 | | |
4444 | | - | |
| 4444 | + | |
4445 | 4445 | | |
4446 | 4446 | | |
4447 | 4447 | | |
| |||
0 commit comments