Skip to content

Commit 3cb0f91

Browse files
committed
BugFix - Potential OOB with Fields of Size 0
Thanks to @hannob for contributing a malformed TNEF stream with a Version field of size 0. Now such files will return an error indicating invalid data.
1 parent 19818f3 commit 3cb0f91

File tree

3 files changed

+6
-0
lines changed

3 files changed

+6
-0
lines changed

Diff for: lib/ytnef.c

+4
Original file line numberDiff line numberDiff line change
@@ -1147,6 +1147,10 @@ int TNEFParse(TNEFStruct *TNEF) {
11471147
while (TNEFGetHeader(TNEF, &type, &size) == 0) {
11481148
DEBUG2(TNEF->Debug, 2, "Header says type=0x%X, size=%u", type, size);
11491149
DEBUG2(TNEF->Debug, 2, "Header says type=%u, size=%u", type, size);
1150+
if(size == 0) {
1151+
printf("ERROR: Field with size of 0\n");
1152+
return YTNEF_ERROR_READING_DATA;
1153+
}
11501154
data = calloc(size, sizeof(BYTE));
11511155
ALLOCCHECK(data);
11521156
if (TNEFRawRead(TNEF, data, size, &header_checksum) < 0) {

Diff for: test-data/test.sh

+2
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,5 @@ diff results data
2121
../ytnefprint/ytnefprint ./winmail.dat | grep -A 1 PR_RTF_SYNC_BODY_CRC | grep 872404792
2222
../ytnefprint/ytnefprint ./winmail.dat | grep -A 1 PR_RTF_SYNC_BODY_COUNT | grep 90
2323
../ytnefprint/ytnefprint ./winmail.dat | grep -A 18 PR_RTF_COMPRESSED | grep '\pard Casdasdfasdfasd\\par'
24+
25+
../ytnefprint/ytnefprint ./ytnef-oob-TNEFVersion-SwapWord | grep 'ERROR: Field with size of 0'

Diff for: test-data/ytnef-oob-TNEFVersion-SwapWord

17 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)