From 0e9292c9aa34bf545f43f7efe5f0b94faba94962 Mon Sep 17 00:00:00 2001 From: Rok Mandeljc Date: Sun, 25 Aug 2019 14:53:58 +0200 Subject: [PATCH 1/2] libMirage: CSO filter: validate part size Part size must be always either smaller than the declared block size (compressed block) or equal to it (raw block). If not, return error - because we allocate our I/O buffer based on the block size. Fixes SF bug #119, which is triggered by part size ending up being larger than the block size. Thanks to Andrea Fioraldi for report and thorough analysis of the issue. --- libmirage/filters/filter-cso/filter-stream.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c index 5f2f5e25..d43aa54a 100644 --- a/libmirage/filters/filter-cso/filter-stream.c +++ b/libmirage/filters/filter-cso/filter-stream.c @@ -120,6 +120,14 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self CSO_Part *prev_part = &self->priv->parts[i-1]; prev_part->comp_size = cur_part->offset - prev_part->offset; + + /* Part size must be either smaller than header->block_size + (compressed block ) or equal to it (raw block) */ + if (prev_part->comp_size > header->block_size) { + MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: invalid part/index entry: part data length (%" G_GINT64_MODIFIER "d) exceeds declared block size (%d)!\n", __debug__, prev_part->comp_size, header->block_size); + g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!")); + return FALSE; + } } } -- 2.22.1