|
 |
5cf55c |
From 1ba660b3300d67b8ce9f6b96bbae0b36fa2d6b06 Mon Sep 17 00:00:00 2001
|
|
|
5cf55c |
From: Guido Draheim <guidod@gmx.de>
|
|
|
5cf55c |
Date: Tue, 13 Mar 2018 01:29:44 +0100
|
|
|
5cf55c |
Subject: [PATCH] check zlib space to be within buffer #39
|
|
|
5cf55c |
|
|
|
5cf55c |
---
|
|
|
5cf55c |
zzip/memdisk.c | 9 +++++++++
|
|
|
5cf55c |
zzip/mmapped.c | 2 ++
|
|
|
5cf55c |
2 files changed, 11 insertions(+)
|
|
|
5cf55c |
|
|
|
5cf55c |
diff --git a/zzip/memdisk.c b/zzip/memdisk.c
|
|
|
5cf55c |
index 3de201c..8d5743d 100644
|
|
|
5cf55c |
--- a/zzip/memdisk.c
|
|
|
5cf55c |
+++ b/zzip/memdisk.c
|
|
|
5cf55c |
@@ -521,11 +521,20 @@ zzip_mem_entry_fopen(ZZIP_MEM_DISK * dir, ZZIP_MEM_ENTRY * entry)
|
|
|
5cf55c |
file->zlib.avail_in = zzip_mem_entry_csize(entry);
|
|
|
5cf55c |
file->zlib.next_in = zzip_mem_entry_to_data(entry);
|
|
|
5cf55c |
|
|
|
5cf55c |
+ debug2("compressed size %i", (int) file->zlib.avail_in);
|
|
|
5cf55c |
+ if (file->zlib.next_in + file->zlib.avail_in >= file->endbuf)
|
|
|
5cf55c |
+ goto error;
|
|
|
5cf55c |
+ if (file->zlib.next_in < file->buffer)
|
|
|
5cf55c |
+ goto error;
|
|
|
5cf55c |
+
|
|
|
5cf55c |
if (! zzip_mem_entry_data_deflated(entry) ||
|
|
|
5cf55c |
inflateInit2(&file->zlib, -MAX_WBITS) != Z_OK)
|
|
|
5cf55c |
{ free (file); return 0; }
|
|
|
5cf55c |
|
|
|
5cf55c |
return file;
|
|
|
5cf55c |
+error:
|
|
|
5cf55c |
+ errno = EBADMSG;
|
|
|
5cf55c |
+ return NULL;
|
|
|
5cf55c |
}
|
|
|
5cf55c |
|
|
|
5cf55c |
zzip__new__ ZZIP_MEM_DISK_FILE *
|
|
|
5cf55c |
diff --git a/zzip/mmapped.c b/zzip/mmapped.c
|
|
|
5cf55c |
index 920c4df..8af18f4 100644
|
|
|
5cf55c |
--- a/zzip/mmapped.c
|
|
|
5cf55c |
+++ b/zzip/mmapped.c
|
|
|
5cf55c |
@@ -654,6 +654,8 @@ zzip_disk_entry_fopen(ZZIP_DISK * disk, ZZIP_DISK_ENTRY * entry)
|
|
|
5cf55c |
DBG2("compressed size %i", (int) file->zlib.avail_in);
|
|
|
5cf55c |
if (file->zlib.next_in + file->zlib.avail_in >= disk->endbuf)
|
|
|
5cf55c |
goto error;
|
|
|
5cf55c |
+ if (file->zlib.next_in < disk->buffer)
|
|
|
5cf55c |
+ goto error;
|
|
|
5cf55c |
|
|
|
5cf55c |
if (! zzip_file_header_data_deflated(header))
|
|
|
5cf55c |
goto error;
|