|
1 | 1 | /* This file is part of libmspack. |
2 | | - * (C) 2003-2011 Stuart Caie. |
| 2 | + * (C) 2003-2018 Stuart Caie. |
3 | 3 | * |
4 | 4 | * libmspack is free software; you can redistribute it and/or modify it under |
5 | 5 | * the terms of the GNU Lesser General Public License (LGPL) version 2.1 |
@@ -397,7 +397,7 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh, |
397 | 397 | D(("first pmgl chunk is after last pmgl chunk")) |
398 | 398 | return MSPACK_ERR_DATAFORMAT; |
399 | 399 | } |
400 | | - if (chm->index_root != 0xFFFFFFFF && chm->index_root > chm->num_chunks) { |
| 400 | + if (chm->index_root != 0xFFFFFFFF && chm->index_root >= chm->num_chunks) { |
401 | 401 | D(("index_root outside valid range")) |
402 | 402 | return MSPACK_ERR_DATAFORMAT; |
403 | 403 | } |
@@ -447,7 +447,10 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh, |
447 | 447 | while (num_entries--) { |
448 | 448 | READ_ENCINT(name_len); |
449 | 449 | if (name_len > (unsigned int) (end - p)) goto chunk_end; |
| 450 | + /* consider blank filenames to be an error */ |
| 451 | + if (name_len == 0) goto chunk_end; |
450 | 452 | name = p; p += name_len; |
| 453 | + |
451 | 454 | READ_ENCINT(section); |
452 | 455 | READ_ENCINT(offset); |
453 | 456 | READ_ENCINT(length); |
@@ -622,7 +625,7 @@ static unsigned char *read_chunk(struct mschm_decompressor_p *self, |
622 | 625 | unsigned char *buf; |
623 | 626 |
|
624 | 627 | /* check arguments - most are already checked by chmd_fast_find */ |
625 | | - if (chunk_num > chm->num_chunks) return NULL; |
| 628 | + if (chunk_num >= chm->num_chunks) return NULL; |
626 | 629 |
|
627 | 630 | /* ensure chunk cache is available */ |
628 | 631 | if (!chm->chunk_cache) { |
|
0 commit comments