Skip to content

Commit 2fc57ef

Browse files
committed
Fix CID 1644873: Memory - corruptions (OVERRUN)
* Overrunning buffer pointed to by "ubuf" of 1 bytes by passing it to a function which accesses it at byte offset 2147483647 using argument "e->uncomp_size" (which evaluates to 2147483648).
1 parent fcb8667 commit 2fc57ef

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

src/lib/otezip.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,10 @@ static int otezip_extract_entry(zip_t *za, struct otezip_entry *e, uint8_t **out
467467
uint8_t *ubuf;
468468
#ifdef OTEZIP_ENABLE_STORE
469469
if (e->method == OTEZIP_METHOD_STORE) {
470+
if (e->comp_size != e->uncomp_size) {
471+
free (cbuf);
472+
return -1;
473+
}
470474
ubuf = cbuf;
471475
}
472476
#endif

0 commit comments

Comments
 (0)