Skip to content

Commit

Permalink
Ensure the size of the version field is 4 bytes
Browse files Browse the repository at this point in the history
A corrupted version field size can cause TNEFVersion to access outside
of allocated memory. Check the version is the expected size and raise
an error if not.

Resolves: #86
Reported-by: jasperla
  • Loading branch information
ohwgiles committed Jan 31, 2021
1 parent ecc9d87 commit f9ff4a2
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions lib/ytnef.c
Expand Up @@ -335,6 +335,10 @@ int TNEFRendData STD_ARGLIST {
int TNEFVersion STD_ARGLIST {
WORD major;
WORD minor;
if (size != 2 * sizeof(WORD)) {
printf("Incorrect size of version field, suspected corruption\n");
return -1;
}
minor = SwapWord((BYTE*)data, size);
major = SwapWord((BYTE*)data + 2, size - 2);

Expand Down

0 comments on commit f9ff4a2

Please sign in to comment.