PhotoRec: remove an useless check in header_check_fcs() and fix the OOB read check

This commit is contained in:
Christophe Grenier 2018-02-18 09:44:33 +01:00
parent de55395de3
commit e91d143583

View file

@ -94,8 +94,6 @@ static uint64_t ascii2int2(const unsigned char *string, const unsigned int max_l
static int header_check_fcs(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
if(memcmp(buffer, fcs_signature, sizeof(fcs_signature))==0)
{
const struct fcs_header *fcs=(const struct fcs_header*)buffer;
uint64_t text_start;
uint64_t text_end;
@ -116,19 +114,20 @@ static int header_check_fcs(const unsigned char *buffer, const unsigned int buff
{ /* Explore TEXT segment */
unsigned int i;
const char delimiter=buffer[text_start];
for(i=0;i<text_end && i<buffer_size;i++)
const unsigned int smallest=(buffer_size < text_end ? buffer_size : text_end);
for(i=0; i<smallest; i++)
{
if(buffer[i]==delimiter)
{
if(i+1+8+1<text_end &&
if(i+1+8+1 < smallest &&
memcmp(buffer+i+1,"$ENDDATA",8)==0 && buffer[i+1+8]==delimiter)
data_end=ascii2int2(&buffer[i+1+8+1], text_end-(i+1+8+1), delimiter);
else if(i+1+9+1<text_end &&
data_end=ascii2int2(&buffer[i+1+8+1], smallest-(i+1+8+1), delimiter);
else if(i+1+9+1 < smallest &&
memcmp(buffer+i+1,"$ENDSTEXT",9)==0 && buffer[i+1+9]==delimiter)
stext_end=ascii2int2(&buffer[i+1+9+1], text_end-(i+1+9+1), delimiter);
else if(i+1+12+1<text_end &&
stext_end=ascii2int2(&buffer[i+1+9+1], smallest-(i+1+9+1), delimiter);
else if(i+1+12+1 < smallest &&
memcmp(buffer+i+1,"$ENDANALYSIS",12)==0 && buffer[i+1+12]==delimiter)
analysis_end=ascii2int2(&buffer[i+1+12+1], text_end-(i+1+12+1), delimiter);
analysis_end=ascii2int2(&buffer[i+1+12+1], smallest-(i+1+12+1), delimiter);
}
}
}
@ -148,6 +147,4 @@ static int header_check_fcs(const unsigned char *buffer, const unsigned int buff
file_recovery_new->data_check=&data_check_size;
file_recovery_new->file_check=&file_check_size;
return 1;
}
return 0;
}