Ver código fonte

LibCompress: Check for impossible back references in DeflateDecompressor

This commit makes sure that we fail if an encoded lz77 back reference
references bytes that are outside our sliding window, instead of just
silently failing, which triggers an assertion down the line.
Idan Horowitz 4 anos atrás
pai
commit
071ee7c6f4
1 arquivos alterados com 4 adições e 0 exclusões
  1. 4 0
      Userland/Libraries/LibCompress/Deflate.cpp

+ 4 - 0
Userland/Libraries/LibCompress/Deflate.cpp

@@ -178,6 +178,10 @@ bool DeflateDecompressor::CompressedBlock::try_read_more()
         for (size_t idx = 0; idx < length; ++idx) {
         for (size_t idx = 0; idx < length; ++idx) {
             u8 byte = 0;
             u8 byte = 0;
             m_decompressor.m_output_stream.read({ &byte, sizeof(byte) }, distance);
             m_decompressor.m_output_stream.read({ &byte, sizeof(byte) }, distance);
+            if (m_decompressor.m_output_stream.handle_any_error()) {
+                m_decompressor.set_fatal_error();
+                return false; // a back reference was requested that was too far back (outside our current sliding window)
+            }
             m_decompressor.m_output_stream << byte;
             m_decompressor.m_output_stream << byte;
         }
         }