wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 23:27:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

[libjar] Add some extra sanity checks to our Zip reader.

Browse source
This commit is contained in:
Moonchild 2022-12-15 11:49:39 +00:00 • committed by roytam1
commit a876dc7420
1 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
modules/libjar/nsZipArchive.cpp
View file

@ -885,15 +885,22 @@ nsZipHandle* nsZipArchive::GetFD()
uint32_t nsZipArchive::GetDataOffset(nsZipItem* aItem) uint32_t nsZipArchive::GetDataOffset(nsZipItem* aItem)
{ {
MOZ_ASSERT(aItem); MOZ_ASSERT(aItem);
uint32_t offset;
MOZ_WIN_MEM_TRY_BEGIN MOZ_WIN_MEM_TRY_BEGIN
//-- read local header to get variable length values and calculate //-- read local header to get variable length values and calculate
//-- the real data offset //-- the real data offset
uint32_t len = mFd->mLen; uint32_t len = mFd->mLen;
const uint8_t* data = mFd->mFileData; const uint8_t* data = mFd->mFileData;
uint32_t offset = aItem->LocalOffset(); offset = aItem->LocalOffset();
if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE) if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE)
return 0; return 0;
// Check there's enough space for the signature
if (offset > mFd->mLen) {
NS_WARNING("Corrupt local offset in JAR file");
return 0;
}
// -- check signature before using the structure, in case the zip file is corrupt // -- check signature before using the structure, in case the zip file is corrupt
ZipLocal* Local = (ZipLocal*)(data + offset); ZipLocal* Local = (ZipLocal*)(data + offset);
if ((xtolong(Local->signature) != LOCALSIG)) if ((xtolong(Local->signature) != LOCALSIG))
@ -906,8 +913,14 @@ MOZ_WIN_MEM_TRY_BEGIN
xtoint(Local->filename_len) + xtoint(Local->filename_len) +
xtoint(Local->extrafield_len); xtoint(Local->extrafield_len);
return offset; // Check data points inside the file.
if (offset > mFd->mLen) {
NS_WARNING("Corrupt data offset in JAR file");
return 0;
}
MOZ_WIN_MEM_TRY_CATCH(return 0) MOZ_WIN_MEM_TRY_CATCH(return 0)
// Can't be 0
return offset;
} }
//--------------------------------------------- //---------------------------------------------