Fix heap overflow in pefromupx()

git-svn: trunk@2180

clamav-devel/ChangeLog

@@ -1,3 +1,8 @@
+Mon Aug  7 17:06:41 CEST 2006 (acab)
+------------------------------------
+  * libclamav/upx.c:    Fix heap overflow in pefromupx()
+                        (discovered by Damian Put)
+
 Sun Aug  6 18:32:04 BST 2006 (njh)
 ----------------------------------
   * clamav-milter:	Guess the version information if daily.cvd doesn't

clamav-devel/libclamav/upx.c

@@ -177,6 +177,10 @@ int pefromupx (char *src, char *dst, uint32_t *dsize, uint32_t ep, uint32_t upx0
   /* CBA restoring the imports they'll look different from the originals anyway... */
   /* ...and yeap i miss the icon too :P */
 
+  if (foffset > *dsize) {
+    cli_dbgmsg("UPX: wrong raw size - giving up rebuild\n");
+    return 0;
+  }
   memcpy(dst, newbuf, foffset);
   *dsize = foffset;
   free(newbuf);