luisgulo/testdisk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

PhotoRec: fix potential endless loop/crash when parsing abr files,

Browse source 
use uint64_t when parsing exe, gpg, hdf, indd files
fix calculate_packet_size() prototype
This commit is contained in:
Christophe Grenier 2018-02-26 10:08:48 +01:00
parent d13e22df20
commit 8fd2739598
6 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/file_abr.c
View file

@ -27,6 +27,7 @@
#include <string.h>
#endif
#include <stdio.h>
#include <assert.h>
#include "types.h"
#include "filegen.h"
#include "common.h"
@ -65,8 +66,9 @@ static data_check_t data_check_abr(const unsigned char *buffer, const unsigned i
static int header_check_abr(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
const struct abr_header *hdr=(const struct abr_header*)&buffer[4];
unsigned int i=4;
while(i + 12 < buffer_size && i + 12 < 512)
uint64_t i=4;
assert(buffer_size >= 12);
while(i < buffer_size - 12 && i < 512 - 12)
{
const struct abr_header *h=(const struct abr_header*)&buffer[i];
if(memcmp(h->magic, "8BIM", 4)!=0)

2
src/file_exe.c
View file

@ -178,7 +178,7 @@ static int header_check_exe(const unsigned char *buffer, const unsigned int buff
if(le16(dos_hdr->bytes_in_last_block))
coff_offset-=512-le16(dos_hdr->bytes_in_last_block);
if(coff_offset+1 < buffer_size &&
if(coff_offset < buffer_size-1 &&
buffer[coff_offset]==0x4c && buffer[coff_offset+1]==0x01)
{ /* COFF_I386MAGIC */
reset_file_recovery(file_recovery_new);

2
src/file_gpg.c
View file

@ -410,9 +410,9 @@ static void file_check_gpg(file_recovery_t *file_recovery)
static int header_check_gpg(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
uint64_t i=0;
unsigned int packet_tag[16];
unsigned int nbr=0;
unsigned int i=0;
int partial_body_length=0;
int stop=0;
memset(packet_tag, 0, sizeof(packet_tag));

8
src/file_hdf.c
View file

@ -65,8 +65,8 @@ struct dd_struct
static void file_check_hdf(file_recovery_t *file_recovery)
{
uint64_t file_size=0;
unsigned int offset_old=4;
unsigned int offset=4;
uint64_t offset_old;
uint64_t offset=4;
struct dd_struct *dd=(struct dd_struct *)MALLOC(sizeof(struct dd_struct)*65536);
do
{
@ -96,8 +96,8 @@ static void file_check_hdf(file_recovery_t *file_recovery)
be16(p->tag), be16(p->ref), be32(p->offset), be32(p->length));
#endif
if((unsigned)be32(p->offset)!=(unsigned)(-1) &&
file_size < (unsigned)be32(p->offset) + (unsigned)be32(p->length))
file_size = (unsigned)be32(p->offset) + (unsigned)be32(p->length);
file_size < (uint64_t)be32(p->offset) + (uint64_t)be32(p->length))
file_size = (uint64_t)be32(p->offset) + (uint64_t)be32(p->length);
}
offset_old=offset;
offset=be32(ddh.next);

2
src/file_indd.c
View file

@ -103,7 +103,7 @@ static void file_check_indd(file_recovery_t *file_recovery)
return ;
}
/* header + data + trailer */
offset+=le32(hdr.fStreamLength)+2*sizeof(struct InDesignContigObjMarker);
offset+=(uint64_t)le32(hdr.fStreamLength)+2*sizeof(struct InDesignContigObjMarker);
} while(offset < file_size_org);
file_recovery->file_size=(offset+4096-1)/4096*4096;
if(file_recovery->file_size>file_size_org)

2
src/file_mpg.c
View file

@ -42,7 +42,7 @@ const file_hint_t file_hint_mpg= {
.register_header_check=&register_header_check_mpg
};
static int calculate_packet_size(const unsigned char *buffer)
static unsigned int calculate_packet_size(const unsigned char *buffer)
{
/* http://dvd.sourceforge.net/dvdinfo/mpeghdrs.html */
if(buffer[0]!=0 || buffer[1]!=0 || buffer[2]!=1)