Skip to content

Commit 40ef1b4

Browse files
committed
CAB block input buffer is one byte too small for maximal Quantum block
1 parent 8759da8 commit 40ef1b4

File tree

2 files changed

+18
-2
lines changed

2 files changed

+18
-2
lines changed

Diff for: libmspack/ChangeLog

+8
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
2018-10-17 Stuart Caie <kyzer@cabextract.org.uk>
2+
3+
* cab.h: Make the CAB block input buffer one byte larger, to allow
4+
a maximum-allowed-size input block and the special extra byte added
5+
after the block by cabd_sys_read_block to help Quantum alignment.
6+
Thanks to Henri Salo for reporting this.
7+
8+
19
2018-10-17 Stuart Caie <kyzer@cabextract.org.uk>
210

311
* chmd_read_headers(): again reject files with blank filenames, this

Diff for: libmspack/mspack/cab.h

+10-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This file is part of libmspack.
2-
* (C) 2003-2004 Stuart Caie.
2+
* (C) 2003-2018 Stuart Caie.
33
*
44
* libmspack is free software; you can redistribute it and/or modify it under
55
* the terms of the GNU Lesser General Public License (LGPL) version 2.1
@@ -70,6 +70,14 @@
7070
#define CAB_BLOCKMAX (32768)
7171
#define CAB_INPUTMAX (CAB_BLOCKMAX+6144)
7272

73+
/* input buffer needs to be CAB_INPUTMAX + 1 byte to allow for max-sized block
74+
* plus 1 trailer byte added by cabd_sys_read_block() for Quantum alignment.
75+
*
76+
* When MSCABD_PARAM_SALVAGE is set, block size is not checked so can be
77+
* up to 65535 bytes, so max input buffer size needed is 65535 + 1
78+
*/
79+
#define CAB_INPUTBUF (65535 + 1)
80+
7381
/* There are no more than 65535 data blocks per folder, so a folder cannot
7482
* be more than 32768*65535 bytes in length. As files cannot span more than
7583
* one folder, this is also their max offset, length and offset+length limit.
@@ -101,7 +109,7 @@ struct mscabd_decompress_state {
101109
struct mspack_file *infh; /* input file handle */
102110
struct mspack_file *outfh; /* output file handle */
103111
unsigned char *i_ptr, *i_end; /* input data consumed, end */
104-
unsigned char input[CAB_INPUTMAX]; /* one input block of data */
112+
unsigned char input[CAB_INPUTBUF]; /* one input block of data */
105113
};
106114

107115
struct mscab_decompressor_p {

0 commit comments

Comments
 (0)