From dd84600b5fa3a2588acdcaf80d92fd358a82aebe Mon Sep 17 00:00:00 2001 From: Zac Medico Date: Sun, 27 Oct 2019 13:03:28 -0700 Subject: [PATCH 1/3] bdeltaReconstructDCBuff: validate int_size The int_size must be in the range 1 to 4 in order to avoid BUFF_SIZE overflow or a negative left shift. Bug: https://bugs.gentoo.org/543310 Reported-by: Aidan Thornton Signed-off-by: Zac Medico --- libdiffball/bdelta.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libdiffball/bdelta.c b/libdiffball/bdelta.c index 195ca3d..487140c 100644 --- a/libdiffball/bdelta.c +++ b/libdiffball/bdelta.c @@ -171,6 +171,8 @@ bdeltaReconstructDCBuff(DCB_SRC_ID src_id, cfile *patchf, CommandBuffer *dcbuff) cread(patchf, buff, 1); int_size = buff[0]; v2printf("int_size=%u\n", int_size); + if(int_size < 1 || int_size > 4) + return PATCH_CORRUPT_ERROR; /* yes, this is an intentional switch fall through. */ switch(int_size) { case 1: or_mask |= 0x0000ff00; From db4a965ca35ae247713bcd5b0d94ef776cdabc15 Mon Sep 17 00:00:00 2001 From: Zac Medico Date: Sun, 27 Oct 2019 13:53:05 -0700 Subject: [PATCH 2/3] gdiffReconstructDCBuff: increase buff_size from 5 to 13 The buff_size must be at least 13 in order to accomodate cread and readUBytesBE calls relative to buff + 1 with ob = 8 and lb = 4. Bug: https://bugs.gentoo.org/543310 Reported-by: Aidan Thornton Signed-off-by: Zac Medico --- libdiffball/gdiff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libdiffball/gdiff.c b/libdiffball/gdiff.c index 6df0f1f..8d065e9 100644 --- a/libdiffball/gdiff.c +++ b/libdiffball/gdiff.c @@ -192,7 +192,7 @@ signed int gdiffReconstructDCBuff(DCB_SRC_ID src_id, cfile *patchf, CommandBuffer *dcbuff, unsigned int offset_type) { - const unsigned int buff_size = 5; + const unsigned int buff_size = 13; unsigned char buff[buff_size]; off_u32 len, dc_pos=0; off_u64 ver_pos=0; From 4e60e54a11fc1de0a85f54b9332062b173f98676 Mon Sep 17 00:00:00 2001 From: Zac Medico Date: Sun, 27 Oct 2019 14:49:16 -0700 Subject: [PATCH 3/3] readXDInt: limit count to 31 Since buff points to a 32-byte stack buffer, count must not exceed 31. Bug: https://bugs.gentoo.org/543310 Reported-by: Aidan Thornton Signed-off-by: Zac Medico --- libdiffball/xdelta1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libdiffball/xdelta1.c b/libdiffball/xdelta1.c index 563d1cc..1902f91 100644 --- a/libdiffball/xdelta1.c +++ b/libdiffball/xdelta1.c @@ -54,7 +54,7 @@ readXDInt(cfile *patchf, unsigned char *buff) do { count++; cread(patchf, buff + count, 1); - } while(buff[count] & 0x80); + } while(count < 31 && buff[count] & 0x80); for(; count >= 0; count--) { num <<= 7; num |= (buff[count] & 0x7f);