Sfoglia il codice sorgente

qpak: Fix possible buffer overflow in maliciously-crafted file.

Reference Issue #79.
Ryan C. Gordon 2 mesi fa
parent
commit
de4c0c7309
1 ha cambiato i file con 3 aggiunte e 1 eliminazioni
  1. 3 1
      src/physfs_archiver_qpak.c

+ 3 - 1
src/physfs_archiver_qpak.c

@@ -43,10 +43,12 @@ static int qpakLoadEntries(PHYSFS_Io *io, const PHYSFS_uint32 count, void *arc)
     {
         PHYSFS_uint32 size;
         PHYSFS_uint32 pos;
-        char name[56];
+        char name[57];  /* 56 bytes plus a null terminator. */
         BAIL_IF_ERRPASS(!__PHYSFS_readAll(io, name, 56), 0);
         BAIL_IF_ERRPASS(!__PHYSFS_readAll(io, &pos, 4), 0);
         BAIL_IF_ERRPASS(!__PHYSFS_readAll(io, &size, 4), 0);
+        BAIL_IF_ERRPASS(!__PHYSFS_readAll(io, &size, 4), 0);
+        name[sizeof (name) - 1] = '\0';  /* make sure this is definitely null-terminated. */
         size = PHYSFS_swapULE32(size);
         pos = PHYSFS_swapULE32(pos);
         BAIL_IF_ERRPASS(!UNPK_addEntry(arc, name, 0, -1, -1, pos, size), 0);