Detect bad b_info.method
https://issues.oss-fuzz.com/u/1/issues?q=upx modified: p_lx_elf.cpp modified: p_unix.cpp modified: packhead.cpp modified: packhead.h
This commit is contained in:
+2
-2
@@ -485,7 +485,6 @@ unsigned PackUnix::unpackExtent(unsigned wanted, OutputFile *fo,
|
||||
fi->readx(&hdr, szb_info);
|
||||
int const sz_unc = ph.u_len = get_te32(&hdr.sz_unc);
|
||||
int const sz_cpr = ph.c_len = get_te32(&hdr.sz_cpr);
|
||||
ph.method = hdr.b_method;
|
||||
ph.filter_cto = hdr.b_cto8;
|
||||
|
||||
if (sz_unc == 0 || M_LZMA < hdr.b_method) {
|
||||
@@ -508,6 +507,7 @@ unsigned PackUnix::unpackExtent(unsigned wanted, OutputFile *fo,
|
||||
c_adler = upx_adler32(ibuf + j, sz_cpr, c_adler);
|
||||
|
||||
if (sz_cpr < sz_unc) { // block was compressed
|
||||
ph.set_method(hdr.b_method);
|
||||
decompress(ibuf+j, ibuf+inlen, false);
|
||||
if (12==szb_info) { // modern per-block filter
|
||||
if (hdr.b_ftid) {
|
||||
@@ -658,7 +658,7 @@ void PackUnix::unpack(OutputFile *fo)
|
||||
fi->readx(&bhdr, szb_info);
|
||||
ph.u_len = sz_unc = get_te32(&bhdr.sz_unc);
|
||||
ph.c_len = sz_cpr = get_te32(&bhdr.sz_cpr);
|
||||
ph.method = bhdr.b_method;
|
||||
ph.set_method(bhdr.b_method);
|
||||
|
||||
if (sz_unc == 0) // uncompressed size 0 -> EOF
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user