changed/fixed: add some sanity checks to rar code to avoid crashes wi…

…th corrupt archives.
xbmc · Nov 15, 2011 · f0b4837 · f0b4837
1 parent dab7e1a
commit f0b4837
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/lib/UnrarXLib/rar.cpp b/lib/UnrarXLib/rar.cpp
@@ -345,6 +345,13 @@ int urarlib_list(char *rarfile, ArchiveList_struct **ppList, char *libpassword,
               if (!*ppList)
                 *ppList = pCurr;
               pCurr->item.NameSize = strlen(pArc->NewLhd.FileName);
+              // sanity check - if it fails the archive is likely corrupt
+              if (pCurr->item.NameSize > NM)
+              {
+                File::RemoveCreated();
+                return 0;
+              }
+
               pCurr->item.Name = (char *)malloc(pCurr->item.NameSize + 1);
               strcpy(pCurr->item.Name, pArc->NewLhd.FileName);
               pCurr->item.NameW = (wchar *)malloc((pCurr->item.NameSize + 1)*sizeof(wchar));
@@ -365,6 +372,11 @@ int urarlib_list(char *rarfile, ArchiveList_struct **ppList, char *libpassword,
                 break;
             }
             iOffset = pArc->NextBlockPos;
+            if (iOffset > pArc->FileLength())
+            {
+              File::RemoveCreated();
+              return 0;
+            }
             pArc->SeekToNext();
           }
           if (pCmd->VolSize!=0 && ((pArc->NewLhd.Flags & LHD_SPLIT_AFTER) || (pArc->GetHeaderType()==ENDARC_HEAD && (pArc->EndArcHead.Flags & EARC_NEXT_VOLUME)!=0)))

diff --git a/xbmc/filesystem/RarDirectory.cpp b/xbmc/filesystem/RarDirectory.cpp
@@ -71,7 +71,10 @@ namespace XFILE
       return( true);
     }
     else
+    {
+      CLog::Log(LOGWARNING,"%s: rar lib returned no files in archive %s, likely corrupt",__FUNCTION__,strArchive.c_str());
       return( false );
+    }
   }
 
   bool CRarDirectory::Exists(const char* strPath)