fix: properly propagate location overflows

This commit is contained in:
Alain Zscheile 2023-01-13 16:56:55 +01:00
parent 7a54e48a09
commit 946c991073
4 changed files with 7 additions and 6 deletions

View file

@ -93,7 +93,7 @@ impl<'a> Ref<'a> {
pub fn parse(data: &'a [u8], location: u32) -> Option<Self> {
let alldata = data;
let uf = <usize as TryFrom<u32>>::try_from;
let offset = crate::decode_location(location);
let offset = crate::decode_location(location)?;
let data = data.get(offset..)?;
let header = Header::parse(data)?;

View file

@ -72,7 +72,8 @@ impl<'a> X2dhc<'a> {
}
fn lookup_internal(data: &'a [u8], xybits2: u8, x: u8, y: u8) -> (u64, u64) {
let loc = decode_location(xy2d(xybits2, x.into(), y.into()));
// SAFETY: the `exp_len` check above should ensure that this is always valid
let loc = decode_location(xy2d(xybits2, x.into(), y.into())).unwrap();
let dloc = &data[loc..loc + 16];
(
u64::from_be_bytes(dloc[0..8].try_into().unwrap()),

View file

@ -78,6 +78,6 @@ pub fn trunc_key_at0(key: &[u8]) -> &[u8] {
&key[..key_end]
}
pub fn decode_location(location: u32) -> usize {
16 * usize::try_from(location).unwrap()
pub fn decode_location(location: u32) -> Option<usize> {
usize::try_from(location).ok()?.checked_mul(16)
}

View file

@ -18,7 +18,7 @@ pub struct Ref<'a> {
impl<'a> Ref<'a> {
pub fn parse(data: &'a [u8], location: u32) -> Option<Self> {
let sel = decode_location(location);
let sel = decode_location(location)?;
if data.len() < (sel + 16) {
return None;
}
@ -26,7 +26,7 @@ impl<'a> Ref<'a> {
let strtab_link = u32::from_be_bytes(sel[0..4].try_into().unwrap());
let entcount = u16::from_be_bytes(sel[4..6].try_into().unwrap());
let entsize = u16::from_be_bytes(sel[6..8].try_into().unwrap());
let strtab_loc = decode_location(strtab_link);
let strtab_loc = decode_location(strtab_link)?;
let dataspan = 16..(16 + 16 * usize::from(entsize) * usize::from(entcount));
if data.len() <= strtab_loc || entsize == 0 {