| 修訂 | 2f6c23df5518b6edc2f61161b1853e3817643f58 (tree) |
|---|---|
| 時間 | 2016-01-23 12:38:32 |
| 作者 | Koji Arai <jca02266@gmai...> |
| Commiter | Koji Arai |
Fix a BUG skip size become negative in the skip_bytes() function, when the extended header size is too short
src/header.c (diff)| @@ -37,7 +37,7 @@ static char *start_ptr; | ||
| 37 | 37 | #else |
| 38 | 38 | #define setup_get(PTR) (get_ptr = (PTR)) |
| 39 | 39 | #define get_byte() GET_BYTE() |
| 40 | -#define skip_bytes(len) (get_ptr += (len)) | |
| 40 | +#define skip_bytes(len) _skip_bytes(len) | |
| 41 | 41 | #endif |
| 42 | 42 | #define put_ptr get_ptr |
| 43 | 43 | #define setup_put(PTR) (put_ptr = (PTR)) |
| @@ -68,6 +68,16 @@ calc_sum(p, len) | ||
| 68 | 68 | return sum & 0xff; |
| 69 | 69 | } |
| 70 | 70 | |
| 71 | +static void | |
| 72 | +_skip_bytes(len) | |
| 73 | +{ | |
| 74 | + if (len < 0) { | |
| 75 | + error("Invalid header: %d", len); | |
| 76 | + exit(1); | |
| 77 | + } | |
| 78 | + get_ptr += len; | |
| 79 | +} | |
| 80 | + | |
| 71 | 81 | #if DUMP_HEADER |
| 72 | 82 | static int |
| 73 | 83 | dump_get_byte() |
| @@ -93,12 +103,16 @@ dump_skip_bytes(len) | ||
| 93 | 103 | if (len == 0) return; |
| 94 | 104 | if (verbose_listing && verbose > 1) { |
| 95 | 105 | printf("%02d %2d: ", get_ptr - start_ptr, len); |
| 106 | + if (len < 0) { | |
| 107 | + error("Invalid header: %d", len); | |
| 108 | + exit(1); | |
| 109 | + } | |
| 96 | 110 | while (len--) |
| 97 | 111 | printf("0x%02x ", GET_BYTE()); |
| 98 | 112 | printf("... ignored\n"); |
| 99 | 113 | } |
| 100 | 114 | else |
| 101 | - get_ptr += len; | |
| 115 | + _skip_bytes(len); | |
| 102 | 116 | } |
| 103 | 117 | #endif |
| 104 | 118 |
Fork