You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
26 lines
997 B
26 lines
997 B
From 111c0f374ae8f9c4d2183fb9e826d7084c85488f Mon Sep 17 00:00:00 2001
|
|
From: David Tardon <dtardon@redhat.com>
|
|
Date: Fri, 31 Jul 2015 17:58:29 +0200
|
|
Subject: [PATCH] rhbz#1248443 unbounded heap allocation
|
|
|
|
---
|
|
src/lib/RVNGOLEStream.cpp | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/lib/RVNGOLEStream.cpp b/src/lib/RVNGOLEStream.cpp
|
|
index 89055f7..c75b135 100644
|
|
--- a/src/lib/RVNGOLEStream.cpp
|
|
+++ b/src/lib/RVNGOLEStream.cpp
|
|
@@ -755,6 +755,8 @@ bool librevenge::Header::valid(const unsigned long fileSize)
|
|
if (m_threshold != 4096) return false;
|
|
// there must be at least the header, one bat sector and one dirent sector in the file
|
|
if ((fileSize / m_size_bbat) < 3) return false;
|
|
+ // sectors must fit into the file
|
|
+ if ((fileSize / m_size_bbat) < m_num_mbat) return false;
|
|
if (m_num_bat == 0) return false;
|
|
if ((m_num_bat > 109) && (m_num_bat > (m_num_mbat * (m_size_bbat/4-1)) + 109)) return false;
|
|
if ((m_num_bat < 109) && (m_num_mbat != 0)) return false;
|
|
--
|
|
2.1.0
|
|
|