libmspack/CVE-2019-1010305.patch

42 lines
1.5 KiB
Diff
Raw Normal View History

2019-09-30 10:57:07 -04:00
Backported of:
From 2f084136cfe0d05e5bf5703f3e83c6d955234b4d Mon Sep 17 00:00:00 2001
From: Stuart Caie <kyzer@cabextract.org.uk>
Date: Mon, 18 Feb 2019 13:04:58 +0000
Subject: [PATCH] length checks when looking for control files
diff --git a/mspack/chmd.c b/mspack/chmd.c
index 91d926e..4813ccc 100644
--- a/mspack/chmd.c
+++ b/mspack/chmd.c
@@ -483,19 +483,17 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
if (name[0] == ':' && name[1] == ':') {
/* system file */
- if (mspack_memcmp(&name[2], &content_name[2], 31L) == 0) {
- if (mspack_memcmp(&name[33], &content_name[33], 8L) == 0) {
- chm->sec1.content = fi;
- }
- else if (mspack_memcmp(&name[33], &control_name[33], 11L) == 0) {
- chm->sec1.control = fi;
- }
- else if (mspack_memcmp(&name[33], &spaninfo_name[33], 8L) == 0) {
- chm->sec1.spaninfo = fi;
- }
- else if (mspack_memcmp(&name[33], &rtable_name[33], 72L) == 0) {
- chm->sec1.rtable = fi;
- }
+ if (name_len == 40 && memcmp(name, content_name, 40) == 0) {
+ chm->sec1.content = fi;
+ }
+ else if (name_len == 44 && memcmp(name, control_name, 44) == 0) {
+ chm->sec1.control = fi;
+ }
+ else if (name_len == 41 && memcmp(name, spaninfo_name, 41) == 0) {
+ chm->sec1.spaninfo = fi;
+ }
+ else if (name_len == 105 && memcmp(name, rtable_name, 105) == 0) {
+ chm->sec1.rtable = fi;
}
fi->next = chm->sysfiles;
chm->sysfiles = fi;