Skip to content

Commit 72e70a9

Browse files
committed
Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and
reject empty filenames. Thanks to Hanno Böck for reporting
1 parent 631829c commit 72e70a9

File tree

2 files changed

+16
-3
lines changed

2 files changed

+16
-3
lines changed

Diff for: libmspack/ChangeLog

+10
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
2018-04-26 Stuart Caie <kyzer@cabextract.org.uk>
2+
3+
* read_chunk(): the test that chunk numbers are in bounds was off
4+
by one, so read_chunk() returned a pointer taken from outside
5+
allocated memory that usually crashes libmspack when accessed.
6+
Thanks to Hanno Böck for finding the issue and providing a sample.
7+
8+
* chmd_read_headers(): reject files with blank filenames. Thanks
9+
again to Hanno Böck for finding the issue and providing a sample file.
10+
111
2018-02-06 Stuart Caie <kyzer@cabextract.org.uk>
212

313
* chmd.c: fixed an off-by-one error in the TOLOWER() macro, reported

Diff for: libmspack/mspack/chmd.c

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This file is part of libmspack.
2-
* (C) 2003-2011 Stuart Caie.
2+
* (C) 2003-2018 Stuart Caie.
33
*
44
* libmspack is free software; you can redistribute it and/or modify it under
55
* the terms of the GNU Lesser General Public License (LGPL) version 2.1
@@ -397,7 +397,7 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
397397
D(("first pmgl chunk is after last pmgl chunk"))
398398
return MSPACK_ERR_DATAFORMAT;
399399
}
400-
if (chm->index_root != 0xFFFFFFFF && chm->index_root > chm->num_chunks) {
400+
if (chm->index_root != 0xFFFFFFFF && chm->index_root >= chm->num_chunks) {
401401
D(("index_root outside valid range"))
402402
return MSPACK_ERR_DATAFORMAT;
403403
}
@@ -447,7 +447,10 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
447447
while (num_entries--) {
448448
READ_ENCINT(name_len);
449449
if (name_len > (unsigned int) (end - p)) goto chunk_end;
450+
/* consider blank filenames to be an error */
451+
if (name_len == 0) goto chunk_end;
450452
name = p; p += name_len;
453+
451454
READ_ENCINT(section);
452455
READ_ENCINT(offset);
453456
READ_ENCINT(length);
@@ -622,7 +625,7 @@ static unsigned char *read_chunk(struct mschm_decompressor_p *self,
622625
unsigned char *buf;
623626

624627
/* check arguments - most are already checked by chmd_fast_find */
625-
if (chunk_num > chm->num_chunks) return NULL;
628+
if (chunk_num >= chm->num_chunks) return NULL;
626629

627630
/* ensure chunk cache is available */
628631
if (!chm->chunk_cache) {

0 commit comments

Comments
 (0)