Fix signed integer overflow in ZIP reading code
Subtracting a huge negative offset from the current position could overflow it, which was correctly detected as undefined behaviour by UBSAN. Credit to OSS-Fuzz: this solves its issue 4388.
This commit is contained in:
@@ -1719,8 +1719,11 @@ bool wxZipInputStream::LoadEndRecord()
|
|||||||
ReadSignature() == magic) {
|
ReadSignature() == magic) {
|
||||||
m_signature = magic;
|
m_signature = magic;
|
||||||
m_position = endPos - recSize;
|
m_position = endPos - recSize;
|
||||||
m_offsetAdjustment = m_position - endrec.GetOffset();
|
if ( endrec.GetOffset() >= 0 && endrec.GetOffset() < m_position )
|
||||||
return true;
|
{
|
||||||
|
m_offsetAdjustment = m_position - endrec.GetOffset();
|
||||||
|
return true;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
wxLogError(_("can't find central directory in zip"));
|
wxLogError(_("can't find central directory in zip"));
|
||||||
|
Reference in New Issue
Block a user