diff --git libmspack-0.5alpha/mspack/chmd.c libmspack-0.5alpha-a/mspack/chmd.c --- libmspack-0.5alpha/mspack/chmd.c +++ libmspack-0.5alpha-a/mspack/chmd.c @@ -1,5 +1,5 @@ /* This file is part of libmspack. - * (C) 2003-2011 Stuart Caie. + * (C) 2003-2018 Stuart Caie. * * libmspack is free software; you can redistribute it and/or modify it under * the terms of the GNU Lesser General Public License (LGPL) version 2.1 @@ -397,7 +397,7 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh, D(("first pmgl chunk is after last pmgl chunk")) return MSPACK_ERR_DATAFORMAT; } - if (chm->index_root != 0xFFFFFFFF && chm->index_root > chm->num_chunks) { + if (chm->index_root != 0xFFFFFFFF && chm->index_root >= chm->num_chunks) { D(("index_root outside valid range")) return MSPACK_ERR_DATAFORMAT; } @@ -447,7 +447,10 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh, while (num_entries--) { READ_ENCINT(name_len); if (name_len > (unsigned int) (end - p)) goto chunk_end; + /* consider blank filenames to be an error */ + if (name_len == 0) goto chunk_end; name = p; p += name_len; + READ_ENCINT(section); READ_ENCINT(offset); READ_ENCINT(length); @@ -622,7 +625,7 @@ static unsigned char *read_chunk(struct mschm_decompressor_p *self, unsigned char *buf; /* check arguments - most are already checked by chmd_fast_find */ - if (chunk_num > chm->num_chunks) return NULL; + if (chunk_num >= chm->num_chunks) return NULL; /* ensure chunk cache is available */ if (!chm->chunk_cache) {