From f56ba5dd6877930502d97920d89ac0a2e9ae19ee Mon Sep 17 00:00:00 2001 From: Toni Wilen Date: Thu, 9 Apr 2020 14:11:31 +0300 Subject: [PATCH] Exit if out of data or any error detected. --- archivers/wrp/warp.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/archivers/wrp/warp.cpp b/archivers/wrp/warp.cpp index 204235a0..6b9f94ef 100644 --- a/archivers/wrp/warp.cpp +++ b/archivers/wrp/warp.cpp @@ -95,6 +95,9 @@ static uae_s32 ARCunsqueeze(struct zfile *in, struct zfile *out, struct rledata { numnodes = xadIOGetBitsLow(&io, 16); + if (io.err) + return XADERR_ILLEGALDATA; + if(numnodes < 0 || numnodes >= ARCSQNUMVALS) err = XADERR_DECRUNCH; else @@ -115,6 +118,9 @@ static uae_s32 ARCunsqueeze(struct zfile *in, struct zfile *out, struct rledata while(i >= 0 && !io.err) i = node[2*i + xadIOGetBitsLow(&io, 1)]; + if (io.err) + return XADERR_ILLEGALDATA; + i = -(i + 1); /* decode fake node index to original data value */ if(i != ARCSQSPEOF) @@ -441,8 +447,12 @@ struct zfile *unwarp(struct zfile *zf) { int i; for (i = 0; i < size; i++) { - uae_u8 v = zfile_getc (zf); - putrle (v, tmpf, algo == 3 ? &rled : NULL); + uae_s32 v = zfile_getc(zf); + if (v == -1) { + err = XADERR_ILLEGALDATA; + break; + } + putrle((uae_u8)v, tmpf, algo == 3 ? &rled : NULL); } } break; -- 2.47.3