Fix signed integer overflow in ZIP reading code

Subtracting a huge negative offset from the current position could
overflow it, which was correctly detected as undefined behaviour by
UBSAN.

Credit to OSS-Fuzz: this solves its issue 4388.
This commit is contained in:
Vadim Zeitlin
2017-10-28 15:02:12 +02:00
parent 9d97e4e7cc
commit 8415d12c61

View File

@@ -1719,9 +1719,12 @@ bool wxZipInputStream::LoadEndRecord()
ReadSignature() == magic) {
m_signature = magic;
m_position = endPos - recSize;
if ( endrec.GetOffset() >= 0 && endrec.GetOffset() < m_position )
{
m_offsetAdjustment = m_position - endrec.GetOffset();
return true;
}
}
wxLogError(_("can't find central directory in zip"));
m_lasterror = wxSTREAM_READ_ERROR;