libmirage/0001-libMirage-CSO-filter-validate-part-size.patch

From 0e9292c9aa34bf545f43f7efe5f0b94faba94962 Mon Sep 17 00:00:00 2001
From: Rok Mandeljc <rok.mandeljc@gmail.com>
Date: Sun, 25 Aug 2019 14:53:58 +0200
Subject: [PATCH 1/2] libMirage: CSO filter: validate part size

Part size must be always either smaller than the declared block
size (compressed block) or equal to it (raw block). If not, return
error - because we allocate our I/O buffer based on the block size.

Fixes SF bug #119, which is triggered by part size ending up being
larger than the block size. Thanks to Andrea Fioraldi for report
and thorough analysis of the issue.
---
 libmirage/filters/filter-cso/filter-stream.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c
index 5f2f5e25..d43aa54a 100644
--- a/libmirage/filters/filter-cso/filter-stream.c
+++ b/libmirage/filters/filter-cso/filter-stream.c
@@ -120,6 +120,14 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self
             CSO_Part *prev_part = &self->priv->parts[i-1];
 
             prev_part->comp_size = cur_part->offset - prev_part->offset;
+
+            /* Part size must be either smaller than header->block_size
+               (compressed block ) or equal to it (raw block) */
+            if (prev_part->comp_size > header->block_size) {
+                MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: invalid part/index entry: part data length (%" G_GINT64_MODIFIER "d) exceeds declared block size (%d)!\n", __debug__, prev_part->comp_size, header->block_size);
+                g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!"));
+                return FALSE;
+            }
         }
     }
 
-- 
2.22.1