Changeset 997 for rpm/vendor/current/lib/header.c

Timestamp:

Feb 15, 2017, 11:57:06 PM (8 years ago)

Author:

dmik

Message:

rpm: Import version 4.13.0 from vendor.

Source URL: ​http://ftp.rpm.org/releases/rpm-4.13.x/rpm-4.13.0.tar.bz2

File:

• rpm/vendor/current/lib/header.c (modified) (2 diffs)

rpm/vendor/current/lib/header.c

@@ -195 +195 @@
     entryInfo pe = (entryInfo) pev;
     entryInfo info = iv;
-    int i;
+    int i, tsize;
+    int32_t end = 0;
 
     for (i = 0; i < il; i++) {
@@ -205 +206 @@
         info->count = ntohl(pe[i].count);
 
+        /* Previous data must not overlap */
+        if (end > info->offset)
+            return i;
+
         if (hdrchkType(info->type))
             return i;
         if (hdrchkAlign(info->type, info->offset))
             return i;
-        if (hdrchkRange(dl, info->offset))
+
+        /* For string types we can only check the array size is sane */
+        tsize = typeSizes[info->type];
+        if (tsize < 1)
+            tsize = 1;
+
+        /* Verify the data actually fits */
+        end = info->offset + (info->count * tsize);
+        if (hdrchkRange(dl, end))
             return i;
-        if (hdrchkData(info->count))
-            return i;
-
-    }
+    }
+
     return -1;
 }