otomatalabs/furnace
7
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

SafeReader: fix exploit when using negative length

Browse source 
issue #2316
This commit is contained in:
tildearrow 2025-01-10 02:06:14 -05:00
parent 9905981e61
commit 2b064f85bb
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/engine/safeReader.cpp
View file

@ -61,6 +61,7 @@ int SafeReader::read(void* where, size_t count) {
#endif #endif
if (count==0) return 0; if (count==0) return 0;
if (curSeek+count>len) throw EndOfFileException(this,len); if (curSeek+count>len) throw EndOfFileException(this,len);
if (curSeek+count<curSeek) throw EndOfFileException(this,len);
memcpy(where,&buf[curSeek],count); memcpy(where,&buf[curSeek],count);
curSeek+=count; curSeek+=count;
return count; return count;
@ -71,6 +72,7 @@ signed char SafeReader::readC() {
logD("SR: reading char %x:",curSeek); logD("SR: reading char %x:",curSeek);
#endif #endif
if (curSeek+1>len) throw EndOfFileException(this,len); if (curSeek+1>len) throw EndOfFileException(this,len);
if (curSeek+1<curSeek) throw EndOfFileException(this,len);
#ifdef READ_DEBUG #ifdef READ_DEBUG
logD("SR: %.2x",buf[curSeek]); logD("SR: %.2x",buf[curSeek]);
#endif #endif
@ -83,6 +85,7 @@ short SafeReader::readS_BE() {
logD("SR: reading short %x:",curSeek); logD("SR: reading short %x:",curSeek);
#endif #endif
if (curSeek+2>len) throw EndOfFileException(this,len); if (curSeek+2>len) throw EndOfFileException(this,len);
if (curSeek+2<curSeek) throw EndOfFileException(this,len);
short ret; short ret;
memcpy(&ret,&buf[curSeek],2); memcpy(&ret,&buf[curSeek],2);
#ifdef READ_DEBUG #ifdef READ_DEBUG
@ -94,6 +97,7 @@ short SafeReader::readS_BE() {
short SafeReader::readS() { short SafeReader::readS() {
if (curSeek+2>len) throw EndOfFileException(this,len); if (curSeek+2>len) throw EndOfFileException(this,len);
if (curSeek+2<curSeek) throw EndOfFileException(this,len);
short ret; short ret;
memcpy(&ret,&buf[curSeek],2); memcpy(&ret,&buf[curSeek],2);
curSeek+=2; curSeek+=2;
@ -105,6 +109,7 @@ int SafeReader::readI_BE() {
logD("SR: reading int %x:",curSeek); logD("SR: reading int %x:",curSeek);
#endif #endif
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
int ret; int ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -116,6 +121,7 @@ int SafeReader::readI_BE() {
int SafeReader::readI() { int SafeReader::readI() {
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
unsigned int ret; unsigned int ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -124,6 +130,7 @@ int SafeReader::readI() {
int64_t SafeReader::readL() { int64_t SafeReader::readL() {
if (curSeek+8>len) throw EndOfFileException(this,len); if (curSeek+8>len) throw EndOfFileException(this,len);
if (curSeek+8<curSeek) throw EndOfFileException(this,len);
unsigned char ret[8]; unsigned char ret[8];
memcpy(ret,&buf[curSeek],8); memcpy(ret,&buf[curSeek],8);
curSeek+=8; curSeek+=8;
@ -132,6 +139,7 @@ int64_t SafeReader::readL() {
float SafeReader::readF() { float SafeReader::readF() {
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
unsigned int ret; unsigned int ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -143,6 +151,7 @@ float SafeReader::readF() {
double SafeReader::readD() { double SafeReader::readD() {
if (curSeek+8>len) throw EndOfFileException(this,len); if (curSeek+8>len) throw EndOfFileException(this,len);
if (curSeek+8<curSeek) throw EndOfFileException(this,len);
unsigned char ret[8]; unsigned char ret[8];
unsigned char retB[8]; unsigned char retB[8];
memcpy(ret,&buf[curSeek],8); memcpy(ret,&buf[curSeek],8);
@ -165,6 +174,7 @@ short SafeReader::readS() {
logD("SR: reading short %x:",curSeek); logD("SR: reading short %x:",curSeek);
#endif #endif
if (curSeek+2>len) throw EndOfFileException(this,len); if (curSeek+2>len) throw EndOfFileException(this,len);
if (curSeek+2<curSeek) throw EndOfFileException(this,len);
short ret; short ret;
memcpy(&ret,&buf[curSeek],2); memcpy(&ret,&buf[curSeek],2);
#ifdef READ_DEBUG #ifdef READ_DEBUG
@ -176,6 +186,7 @@ short SafeReader::readS() {
short SafeReader::readS_BE() { short SafeReader::readS_BE() {
if (curSeek+2>len) throw EndOfFileException(this,len); if (curSeek+2>len) throw EndOfFileException(this,len);
if (curSeek+2<curSeek) throw EndOfFileException(this,len);
short ret; short ret;
memcpy(&ret,&buf[curSeek],2); memcpy(&ret,&buf[curSeek],2);
curSeek+=2; curSeek+=2;
@ -187,6 +198,7 @@ int SafeReader::readI() {
logD("SR: reading int %x:",curSeek); logD("SR: reading int %x:",curSeek);
#endif #endif
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
int ret; int ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -198,6 +210,7 @@ int SafeReader::readI() {
int SafeReader::readI_BE() { int SafeReader::readI_BE() {
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
unsigned int ret; unsigned int ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -206,6 +219,7 @@ int SafeReader::readI_BE() {
int64_t SafeReader::readL() { int64_t SafeReader::readL() {
if (curSeek+8>len) throw EndOfFileException(this,len); if (curSeek+8>len) throw EndOfFileException(this,len);
if (curSeek+8<curSeek) throw EndOfFileException(this,len);
int64_t ret; int64_t ret;
memcpy(&ret,&buf[curSeek],8); memcpy(&ret,&buf[curSeek],8);
curSeek+=8; curSeek+=8;
@ -214,6 +228,7 @@ int64_t SafeReader::readL() {
float SafeReader::readF() { float SafeReader::readF() {
if (curSeek+4>len) throw EndOfFileException(this,len); if (curSeek+4>len) throw EndOfFileException(this,len);
if (curSeek+4<curSeek) throw EndOfFileException(this,len);
float ret; float ret;
memcpy(&ret,&buf[curSeek],4); memcpy(&ret,&buf[curSeek],4);
curSeek+=4; curSeek+=4;
@ -222,6 +237,7 @@ float SafeReader::readF() {
double SafeReader::readD() { double SafeReader::readD() {
if (curSeek+8>len) throw EndOfFileException(this,len); if (curSeek+8>len) throw EndOfFileException(this,len);
if (curSeek+8<curSeek) throw EndOfFileException(this,len);
double ret; double ret;
memcpy(&ret,&buf[curSeek],8); memcpy(&ret,&buf[curSeek],8);
curSeek+=8; curSeek+=8;