bb11446 - fixing autoit OOB bufferread

10 years ago · 3072cef1f9
parent 41e8fd628f
commit 3072cef1f9
1 changed files with 13 additions and 3 deletions
--- a/libclamav/autoit.c
+++ b/libclamav/autoit.c
@ -261,6 +261,11 @@ static int ea05(cli_ctx *ctx, const uint8_t *base, char *tmpd) {
      continue;
    }

+    if (UNP.csize < sizeof(union unaligned_32)) {
+      cli_dbgmsg("autoit: compressed size too small, skipping\n");
+      continue;
+    }
+
    if (!(UNP.inputbuf = cli_malloc(UNP.csize)))
      return CL_EMEM;
    if (!fmap_need_ptr_once(map, base, UNP.csize)) {
@ -581,6 +586,11 @@ static int ea06(cli_ctx *ctx, const uint8_t *base, char *tmpd) {
      continue;
    }

+    if (UNP.csize < sizeof(union unaligned_32)) {
+      cli_dbgmsg("autoit: compressed size too small, skipping\n");
+      continue;
+    }
+
    files++;
    if (!(UNP.inputbuf = cli_malloc(UNP.csize)))
      return CL_EMEM;