resolve merge conflicts of a47780b to lmp-dev
Test: test_zipfile with known bad files.
Change-Id: I25dde73c9b94d253c8017e441e89cb7339907c7f
diff --git a/libzipfile/centraldir.c b/libzipfile/centraldir.c
index 69cf47a..98eef73 100644
--- a/libzipfile/centraldir.c
+++ b/libzipfile/centraldir.c
@@ -62,11 +62,16 @@
return 0;
}
+static const int kCompressionStored = 0x0;
+static const int kCompressionDeflate = 0x8;
+
static int
read_central_directory_entry(Zipfile* file, Zipentry* entry,
const unsigned char** buf, ssize_t* len)
{
const unsigned char* p;
+ size_t remaining;
+ const unsigned char* bufLimit;
unsigned short extraFieldLength;
unsigned short fileCommentLength;
@@ -74,6 +79,8 @@
unsigned int dataOffset;
p = *buf;
+ remaining = *len;
+ bufLimit = file->buf + file->bufsize;
if (*len < ENTRY_LEN) {
fprintf(stderr, "cde entry not large enough\n");
@@ -94,31 +101,77 @@
localHeaderRelOffset = read_le_int(&p[0x2a]);
p += ENTRY_LEN;
+ remaining -= ENTRY_LEN;
// filename
if (entry->fileNameLength != 0) {
+ if (entry->fileNameLength > remaining) {
+ fprintf(stderr, "cde entry not large enough for file name.\n");
+ return 1;
+ }
+
entry->fileName = p;
} else {
- entry->fileName = NULL;
+ fprintf(stderr, "cde entry does not contain a file name.\n");
+ return 1;
}
p += entry->fileNameLength;
+ remaining -= entry->fileNameLength;
// extra field
+ if (extraFieldLength > remaining) {
+ fprintf(stderr, "cde entry not large enough for extra field.\n");
+ return 1;
+ }
p += extraFieldLength;
+ remaining -= extraFieldLength;
// comment, if any
+ if (fileCommentLength > remaining) {
+ fprintf(stderr, "cde entry not large enough for file comment.\n");
+ return 1;
+ }
+
p += fileCommentLength;
+ remaining -= fileCommentLength;
*buf = p;
+ *len = remaining;
// the size of the extraField in the central dir is how much data there is,
// but the one in the local file header also contains some padding.
p = file->buf + localHeaderRelOffset;
+ if (p >= bufLimit) {
+ fprintf(stderr, "Invalid local header offset for entry.\n");
+ return 1;
+ }
+
extraFieldLength = read_le_short(&p[0x1c]);
dataOffset = localHeaderRelOffset + LFH_SIZE
+ entry->fileNameLength + extraFieldLength;
entry->data = file->buf + dataOffset;
+
+ // Sanity check: make sure that the start of the entry data is within
+ // our allocated buffer.
+ if ((entry->data < file->buf) || (entry->data >= bufLimit)) {
+ fprintf(stderr, "Invalid data offset for entry.\n");
+ return 1;
+ }
+
+ // Sanity check: make sure that the end of the entry data is within
+ // our allocated buffer. We need to look at the uncompressedSize for
+ // stored entries and the compressed size for deflated entries.
+ if ((entry->compressionMethod == kCompressionStored) &&
+ (entry->uncompressedSize > (unsigned int) (bufLimit - entry->data))) {
+ fprintf(stderr, "Invalid uncompressed size for stored entry.\n");
+ return 1;
+ }
+ if ((entry->compressionMethod == kCompressionDeflate) &&
+ (entry->compressedSize > (unsigned int) (bufLimit - entry->data))) {
+ fprintf(stderr, "Invalid uncompressed size for deflated entry.\n");
+ return 1;
+ }
#if 0
printf("file->buf=%p entry->data=%p dataOffset=%x localHeaderRelOffset=%d "
"entry->fileNameLength=%d extraFieldLength=%d\n",
diff --git a/libzipfile/test_zipfile.c b/libzipfile/test_zipfile.c
index 1aaa913..a2f6bc7 100644
--- a/libzipfile/test_zipfile.c
+++ b/libzipfile/test_zipfile.c
@@ -75,7 +75,6 @@
unsize = get_zipentry_size(entry);
size = unsize * 1.001;
scratch = malloc(size);
- printf("scratch=%p\n", scratch);
err = decompress_zipentry(entry, scratch, size);
if (err != 0) {
fprintf(stderr, "error decompressing file\n");
