fixing potential OOB window write when unpacking chm files

libclamav/libmspack-0.5alpha/mspack/lzxd.c

@@ -766,8 +766,13 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
       case LZX_BLOCKTYPE_UNCOMPRESSED:
 	/* as this_run is limited not to wrap a frame, this also means it
 	 * won't wrap the window (as the window is a multiple of 32k) */
+        if (window_posn + this_run > lzx->window_size) {
+                D(("match ran over window boundary"))
+                return lzx->error = MSPACK_ERR_DECRUNCH;
+        }
 	rundest = &window[window_posn];
 	window_posn += this_run;
+
 	while (this_run > 0) {
 	  if ((i = i_end - i_ptr) == 0) {
 	    READ_IF_NEEDED;
@@ -888,8 +893,10 @@ void lzxd_free(struct lzxd_stream *lzx) {
   struct mspack_system *sys;
   if (lzx) {
     sys = lzx->sys;
-    sys->free(lzx->inbuf);
-    sys->free(lzx->window);
+    if(lzx->inbuf)
+        sys->free(lzx->inbuf);
+    if(lzx->window)
+        sys->free(lzx->window);
     sys->free(lzx);
   }
 }

libclamav/libmspack.c

@@ -264,7 +264,11 @@ static void *mspack_fmap_alloc(struct mspack_system *self, size_t num)
 
 static void mspack_fmap_free(void *mem)
 {
-	free(mem);
+    if(mem) {
+        free(mem);
+        mem = NULL;
+    }
+    return;
 }
 
 static void mspack_fmap_copy(void *src, void *dst, size_t num)