diff options
Diffstat (limited to 'patch-delta.c')
| -rw-r--r-- | patch-delta.c | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/patch-delta.c b/patch-delta.c index 56e0a5ede2..b5c8594db6 100644 --- a/patch-delta.c +++ b/patch-delta.c @@ -40,24 +40,31 @@ void *patch_delta(const void *src_buf, unsigned long src_size, cmd = *data++; if (cmd & 0x80) { unsigned long cp_off = 0, cp_size = 0; - if (cmd & 0x01) cp_off = *data++; - if (cmd & 0x02) cp_off |= (*data++ << 8); - if (cmd & 0x04) cp_off |= (*data++ << 16); - if (cmd & 0x08) cp_off |= ((unsigned) *data++ << 24); - if (cmd & 0x10) cp_size = *data++; - if (cmd & 0x20) cp_size |= (*data++ << 8); - if (cmd & 0x40) cp_size |= (*data++ << 16); +#define PARSE_CP_PARAM(bit, var, shift) do { \ + if (cmd & (bit)) { \ + if (data >= top) \ + goto bad_length; \ + var |= ((unsigned) *data++ << (shift)); \ + } } while (0) + PARSE_CP_PARAM(0x01, cp_off, 0); + PARSE_CP_PARAM(0x02, cp_off, 8); + PARSE_CP_PARAM(0x04, cp_off, 16); + PARSE_CP_PARAM(0x08, cp_off, 24); + PARSE_CP_PARAM(0x10, cp_size, 0); + PARSE_CP_PARAM(0x20, cp_size, 8); + PARSE_CP_PARAM(0x40, cp_size, 16); +#undef PARSE_CP_PARAM if (cp_size == 0) cp_size = 0x10000; if (unsigned_add_overflows(cp_off, cp_size) || cp_off + cp_size > src_size || cp_size > size) - break; + goto bad_length; memcpy(out, (char *) src_buf + cp_off, cp_size); out += cp_size; size -= cp_size; } else if (cmd) { - if (cmd > size) - break; + if (cmd > size || cmd > top - data) + goto bad_length; memcpy(out, data, cmd); out += cmd; data += cmd; @@ -75,6 +82,7 @@ void *patch_delta(const void *src_buf, unsigned long src_size, /* sanity check */ if (data != top || size != 0) { + bad_length: error("delta replay has gone wild"); bad: free(dst_buf); |