Skip to content

Commit 2c91aa7

Browse files
authored
Fix benign 1-byte buffer over-write in OLE2 parser
The office art structure for OLE2 documents records the file name length using a `uint8_t`, meaning the name may be up to 255 bytes in length, not including the null terminating byte. If the length is 255 then the parser will write the null-terminating byte just after the end of the name buffer on the stack. This issue does not cause a crash and is not a vulnerability. This fix extends the size of stack array to account for the null terminator. Thank you Michał Dardas for reporting this issue.
1 parent d209051 commit 2c91aa7

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

libclamav/xlm_extract.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4441,7 +4441,7 @@ cl_error_t process_blip_store_container(const unsigned char *blip_store_containe
44414441
const unsigned char *embeddedBlip;
44424442
size_t embeddedBlip_size;
44434443
char *blip_file_name = NULL;
4444-
char blip_name_buffer[255] = {0};
4444+
char blip_name_buffer[256] = {0};
44454445

44464446
if (FBSE_record_data->cbName > 0) {
44474447
memcpy(blip_name_buffer,

0 commit comments

Comments
 (0)