Skip to content

Commit 2f08413

Browse files
committed
length checks when looking for control files
1 parent cb5d78c commit 2f08413

File tree

2 files changed

+19
-13
lines changed

2 files changed

+19
-13
lines changed

Diff for: libmspack/ChangeLog

+8
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
2019-02-18 Stuart Caie <kyzer@cabextract.org.uk>
2+
3+
* chmd_read_headers(): a CHM file name beginning "::" but shorter
4+
than 33 bytes will lead to reading past the freshly-allocated name
5+
buffer - checks for specific control filenames didn't take length
6+
into account. Thanks to ADLab of Venustech for the report and
7+
proof of concept.
8+
19
2018-11-03 Stuart Caie <kyzer@cabextract.org.uk>
210

311
* configure.ac, doc/Makefile.in, doc/Doxyfile.in: remove these

Diff for: libmspack/mspack/chmd.c

+11-13
Original file line numberDiff line numberDiff line change
@@ -483,19 +483,17 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
483483

484484
if (name[0] == ':' && name[1] == ':') {
485485
/* system file */
486-
if (memcmp(&name[2], &content_name[2], 31L) == 0) {
487-
if (memcmp(&name[33], &content_name[33], 8L) == 0) {
488-
chm->sec1.content = fi;
489-
}
490-
else if (memcmp(&name[33], &control_name[33], 11L) == 0) {
491-
chm->sec1.control = fi;
492-
}
493-
else if (memcmp(&name[33], &spaninfo_name[33], 8L) == 0) {
494-
chm->sec1.spaninfo = fi;
495-
}
496-
else if (memcmp(&name[33], &rtable_name[33], 72L) == 0) {
497-
chm->sec1.rtable = fi;
498-
}
486+
if (name_len == 40 && memcmp(name, content_name, 40) == 0) {
487+
chm->sec1.content = fi;
488+
}
489+
else if (name_len == 44 && memcmp(name, control_name, 44) == 0) {
490+
chm->sec1.control = fi;
491+
}
492+
else if (name_len == 41 && memcmp(name, spaninfo_name, 41) == 0) {
493+
chm->sec1.spaninfo = fi;
494+
}
495+
else if (name_len == 105 && memcmp(name, rtable_name, 105) == 0) {
496+
chm->sec1.rtable = fi;
499497
}
500498
fi->next = chm->sysfiles;
501499
chm->sysfiles = fi;

0 commit comments

Comments
 (0)