libmirage/CVE-2019-15757.patch

25 lines
1.1 KiB
Diff

Origin: https://gist.github.com/andreafioraldi/343d9ba64060b548c02362a5e61ec932
---
images/image-nrg/parser.c | 7 +++++++
1 file changed, 7 insertions(+)
Index: libmirage-3.2.2/images/image-nrg/parser.c
===================================================================
--- a/libmirage-3.2.2.orig/images/image-nrg/parser.c
+++ b/libmirage-3.2.2/images/image-nrg/parser.c
@@ -987,6 +987,13 @@ static MirageDisc *mirage_parser_nrg_loa
/* Set CD-ROM as default medium type, will be changed accordingly if there
is a MTYP block provided */
mirage_disc_set_medium_type(self->priv->disc, MIRAGE_MEDIUM_CD);
+ /* Length integrity check */
+ if (self->priv->nrg_data_length == 0) {
+ MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: rg_data_length must be greater than 0!\n", __debug__);
+ g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_IMAGE_FILE_ERROR, Q_("nrg_data_length must be greater than 0!"));
+ succeeded = FALSE;
+ goto end;
+ }
/* Read descriptor data */
self->priv->nrg_data = g_malloc(self->priv->nrg_data_length);