ip7z/7zip
1
0
Fork 0
mirror of https://github.com/ip7z/7zip.git synced 2025-12-06 07:12:00 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fixed memory leak on malformed xz archive parsing

Browse source
This commit is contained in:
Vitalii Sheludchenkov 2025-03-27 15:07:52 +01:00
parent e5431fa6f5
commit 222ead54f4
1 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
C/XzIn.c
View file

@ -117,20 +117,38 @@ static SRes Xz_ReadIndex2(CXzStream *p, const Byte *buf, size_t size, ISzAllocPt
p->numBlocks = numBlocks; p->numBlocks = numBlocks;
p->blocks = (CXzBlockSizes *)ISzAlloc_Alloc(alloc, sizeof(CXzBlockSizes) * numBlocks); p->blocks = (CXzBlockSizes *)ISzAlloc_Alloc(alloc, sizeof(CXzBlockSizes) * numBlocks);
if (!p->blocks) if (!p->blocks)
{
Xz_Free(p, alloc);
return SZ_ERROR_MEM; return SZ_ERROR_MEM;
}
for (i = 0; i < numBlocks; i++) for (i = 0; i < numBlocks; i++)
{ {
CXzBlockSizes *block = &p->blocks[i]; CXzBlockSizes *block = &p->blocks[i];
READ_VARINT_AND_CHECK(buf, pos, size, &block->totalSize) READ_VARINT_AND_CHECK(buf, pos, size, &block->totalSize)
READ_VARINT_AND_CHECK(buf, pos, size, &block->unpackSize) READ_VARINT_AND_CHECK(buf, pos, size, &block->unpackSize)
if (block->totalSize == 0) if (block->totalSize == 0)
{
Xz_Free(p, alloc);
return SZ_ERROR_ARCHIVE; return SZ_ERROR_ARCHIVE;
}
} }
} }
while ((pos & 3) != 0) while ((pos & 3) != 0)
{
if (buf[pos++] != 0) if (buf[pos++] != 0)
{
Xz_Free(p, alloc);
return SZ_ERROR_ARCHIVE; return SZ_ERROR_ARCHIVE;
return (pos == size) ? SZ_OK : SZ_ERROR_ARCHIVE; }
}
if (pos != size)
{
Xz_Free(p, alloc);
return SZ_ERROR_ARCHIVE;
}
return SZ_OK;
} }
static SRes Xz_ReadIndex(CXzStream *p, ILookInStreamPtr stream, UInt64 indexSize, ISzAllocPtr alloc) static SRes Xz_ReadIndex(CXzStream *p, ILookInStreamPtr stream, UInt64 indexSize, ISzAllocPtr alloc)