Fix unsigned integer overflow in ZIP reading code
Blindly adding 4 to an unsigned length field could result in 0 and this led to an infinite loop while iterating over all header fields. Avoid this by promoting the length to int first, before adding 4 to it. Credit to OSS-Fuzz: this solves its issue 4083.
This commit is contained in:
parent
8fe3745b14
commit
5195e788d4
@ -1065,9 +1065,13 @@ bool wxZipEntry::LoadExtraInfo(const char* extraData, wxUint16 extraLen, bool lo
|
||||
return true;
|
||||
}
|
||||
|
||||
fieldLen += 4;
|
||||
extraData += fieldLen;
|
||||
extraLen -= fieldLen;
|
||||
// Avoid "optimizing" the lines below by doing "fieldLen += 4" as this
|
||||
// could overflow wxUint16 range and, at worst, make fieldLen equal to
|
||||
// 0 resulting in an infinite loop. Written as it is now, everything is
|
||||
// promoted to int, which has range large enough to deal with any value
|
||||
// of the field length.
|
||||
extraData += fieldLen + 4;
|
||||
extraLen -= fieldLen + 4;
|
||||
}
|
||||
|
||||
// extraInfo had unknown format
|
||||
|
Loading…
Reference in New Issue
Block a user