|
 |
28fc74 |
From f73ad90e797824569008a054bea6c8215883a3a0 Mon Sep 17 00:00:00 2001
|
|
|
28fc74 |
From: Christos Zoulas <christos@zoulas.com>
|
|
|
28fc74 |
Date: Mon, 26 Aug 2019 14:31:39 +0000
|
|
|
28fc74 |
Subject: [PATCH] Limit the number of elements in a vector (found by oss-fuzz)
|
|
|
28fc74 |
|
|
|
28fc74 |
Upstream-commit: 46a8443f76cec4b41ec736eca396984c74664f84
|
|
|
28fc74 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
28fc74 |
---
|
|
|
28fc74 |
src/cdf.c | 7 +++----
|
|
|
28fc74 |
src/cdf.h | 1 +
|
|
|
28fc74 |
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
28fc74 |
|
|
|
28fc74 |
diff --git a/src/cdf.c b/src/cdf.c
|
|
|
28fc74 |
index 556a3ff..8bb0a6d 100644
|
|
|
28fc74 |
--- a/src/cdf.c
|
|
|
28fc74 |
+++ b/src/cdf.c
|
|
|
28fc74 |
@@ -1013,8 +1013,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
|
|
|
28fc74 |
goto out;
|
|
|
28fc74 |
}
|
|
|
28fc74 |
nelements = CDF_GETUINT32(q, 1);
|
|
|
28fc74 |
- if (nelements == 0) {
|
|
|
28fc74 |
- DPRINTF(("CDF_VECTOR with nelements == 0\n"));
|
|
|
28fc74 |
+ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
|
|
|
28fc74 |
+ DPRINTF(("CDF_VECTOR with nelements == %"
|
|
|
28fc74 |
+ SIZE_T_FORMAT "u\n", nelements));
|
|
|
28fc74 |
goto out;
|
|
|
28fc74 |
}
|
|
|
28fc74 |
slen = 2;
|
|
|
28fc74 |
@@ -1056,8 +1057,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
|
|
|
28fc74 |
goto out;
|
|
|
28fc74 |
inp += nelem;
|
|
|
28fc74 |
}
|
|
|
28fc74 |
- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
|
|
|
28fc74 |
- nelements));
|
|
|
28fc74 |
for (j = 0; j < nelements && i < sh.sh_properties;
|
|
|
28fc74 |
j++, i++)
|
|
|
28fc74 |
{
|
|
|
28fc74 |
diff --git a/src/cdf.h b/src/cdf.h
|
|
|
28fc74 |
index 2f7e554..0505666 100644
|
|
|
28fc74 |
--- a/src/cdf.h
|
|
|
28fc74 |
+++ b/src/cdf.h
|
|
|
28fc74 |
@@ -48,6 +48,7 @@
|
|
|
28fc74 |
typedef int32_t cdf_secid_t;
|
|
|
28fc74 |
|
|
|
28fc74 |
#define CDF_LOOP_LIMIT 10000
|
|
|
28fc74 |
+#define CDF_ELEMENT_LIMIT 100000
|
|
|
28fc74 |
|
|
|
28fc74 |
#define CDF_SECID_NULL 0
|
|
|
28fc74 |
#define CDF_SECID_FREE -1
|
|
|
28fc74 |
--
|
|
|
28fc74 |
2.20.1
|
|
|
28fc74 |
|