MMCMP: Check that end pointer is within the file size

Konstanty · Konstanty · commit c615692e8db3 · 2017-04-24T22:58:54.000+10:00
diff --git a/src/mmcmp.cpp b/src/mmcmp.cpp
@@ -241,6 +241,8 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
 			bb.bitbuffer = 0;
 			bb.pSrc = lpMemFile+dwMemPos+pblk->tt_entries;
 			bb.pEnd = lpMemFile+dwMemPos+pblk->pk_size;
+			if (bb.pEnd > lpMemFile+dwMemLength)
+				bb.pEnd = lpMemFile+dwMemLength;
 			while (subblk < pblk->sub_blk)
 			{
 				UINT newval = 0x10000;
@@ -321,6 +323,8 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
 			bb.bitbuffer = 0;
 			bb.pSrc = lpMemFile+dwMemPos+pblk->tt_entries;
 			bb.pEnd = lpMemFile+dwMemPos+pblk->pk_size;
+			if (bb.pEnd > lpMemFile+dwMemLength)
+				bb.pEnd = lpMemFile+dwMemLength;	
 			while (subblk < pblk->sub_blk)
 			{
 				UINT newval = 0x100;
@@ -353,7 +357,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
 				{
 					newval = d;
 				}
-				if (newval < 0x100 && dwPos < dwSize)
+				if (newval < 0x100 && dwPos < dwSize && dwMemPos < dwMemLength - newval)
 				{
 					int n = ptable[newval];
 					if (pblk->flags & MMCMP_DELTA)

Original file line number	Diff line number	Diff line change
`@@ -241,6 +241,8 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)`
`241`	`241`	`bb.bitbuffer = 0;`
`242`	`242`	`bb.pSrc = lpMemFile+dwMemPos+pblk->tt_entries;`
`243`	`243`	`bb.pEnd = lpMemFile+dwMemPos+pblk->pk_size;`
	`244`	`+ if (bb.pEnd > lpMemFile+dwMemLength)`
	`245`	`+ bb.pEnd = lpMemFile+dwMemLength;`
`244`	`246`	`while (subblk < pblk->sub_blk)`
`245`	`247`	`{`
`246`	`248`	`UINT newval = 0x10000;`
`@@ -321,6 +323,8 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)`
`321`	`323`	`bb.bitbuffer = 0;`
`322`	`324`	`bb.pSrc = lpMemFile+dwMemPos+pblk->tt_entries;`
`323`	`325`	`bb.pEnd = lpMemFile+dwMemPos+pblk->pk_size;`
	`326`	`+ if (bb.pEnd > lpMemFile+dwMemLength)`
	`327`	`+ bb.pEnd = lpMemFile+dwMemLength;`
`324`	`328`	`while (subblk < pblk->sub_blk)`
`325`	`329`	`{`
`326`	`330`	`UINT newval = 0x100;`
`@@ -353,7 +357,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)`
`353`	`357`	`{`
`354`	`358`	`newval = d;`
`355`	`359`	`}`
`356`		`- if (newval < 0x100 && dwPos < dwSize)`
	`360`	`+ if (newval < 0x100 && dwPos < dwSize && dwMemPos < dwMemLength - newval)`
`357`	`361`	`{`
`358`	`362`	`int n = ptable[newval];`
`359`	`363`	`if (pblk->flags & MMCMP_DELTA)`