From a876dc7420f1c2d2e74eb8be46674bda6a14932b Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 15 Dec 2022 11:49:39 +0000
Subject: [PATCH] [libjar] Add some extra sanity checks to our Zip reader.

---
 modules/libjar/nsZipArchive.cpp | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
index b28fddc181..1ee3839baa 100644
--- a/modules/libjar/nsZipArchive.cpp
+++ b/modules/libjar/nsZipArchive.cpp
@@ -885,15 +885,22 @@ nsZipHandle* nsZipArchive::GetFD()
 uint32_t nsZipArchive::GetDataOffset(nsZipItem* aItem)
 {
   MOZ_ASSERT(aItem);
+  uint32_t offset;
 MOZ_WIN_MEM_TRY_BEGIN
   //-- read local header to get variable length values and calculate
   //-- the real data offset
   uint32_t len = mFd->mLen;
   const uint8_t* data = mFd->mFileData;
-  uint32_t offset = aItem->LocalOffset();
+  offset = aItem->LocalOffset();
   if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE)
     return 0;
 
+  // Check there's enough space for the signature
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt local offset in JAR file");
+    return 0;
+  }
+
   // -- check signature before using the structure, in case the zip file is corrupt
   ZipLocal* Local = (ZipLocal*)(data + offset);
   if ((xtolong(Local->signature) != LOCALSIG))
@@ -906,8 +913,14 @@ MOZ_WIN_MEM_TRY_BEGIN
             xtoint(Local->filename_len) +
             xtoint(Local->extrafield_len);
 
-  return offset;
+  // Check data points inside the file.
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt data offset in JAR file");
+    return 0;
+  }
 MOZ_WIN_MEM_TRY_CATCH(return 0)
+  // Can't be 0
+  return offset;
 }
 
 //---------------------------------------------