BPI/sunxi-tools
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fexc: Improve script_decompile_bin() safeguards

Browse Source 
When declaring 'signed' values for section count and version
information in the script_bin_head structure, testing them to be
below certain thresholds (SCRIPT_BIN_*_LIMIT) is insufficient;
as 'negative' values like in "fexc-bin: script.bin: version:
-404840454.-1074397186.-1073906177" would still pass.

Fix this by making these member fields unsigned.

Signed-off-by: Bernhard Nortmann <bernhard.nortmann@web.de>
This commit is contained in:
Bernhard Nortmann 2016-04-20 08:56:16 +02:00
parent a8054dfa9a
commit ef545814de
2 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
script_bin.c
View File

@ -312,17 +312,16 @@ int script_decompile_bin(void *bin, size_t bin_size,
const char *filename,
struct script *script)
{
int i;
unsigned int i;
struct script_bin_head *head = bin;
pr_info("%s: version: %d.%d.%d\n", filename,
head->version[0], head->version[1],
head->version[2]);
pr_info("%s: size: %zu (%d sections)\n", filename,
pr_info("%s: version: %u.%u.%u\n", filename,
head->version[0], head->version[1], head->version[2]);
pr_info("%s: size: %zu (%u sections)\n", filename,
bin_size, head->sections);
if (head->sections > SCRIPT_BIN_SECTION_LIMIT) {
pr_err("Malformed data: too many sections (%d).\n",
pr_err("Malformed data: too many sections (%u).\n",
head->sections);
return 0;
}
@ -330,7 +329,7 @@ int script_decompile_bin(void *bin, size_t bin_size,
if ((head->version[0] > SCRIPT_BIN_VERSION_LIMIT) ||
(head->version[1] > SCRIPT_BIN_VERSION_LIMIT) ||
(head->version[2] > SCRIPT_BIN_VERSION_LIMIT)) {
pr_err("Malformed data: version %d.%d.%d.\n",
pr_err("Malformed data: version %u.%u.%u.\n",
head->version[0], head->version[1], head->version[2]);
return 0;
}

4
script_bin.h
View File

@ -26,8 +26,8 @@ struct script_bin_section {
/** binary representation of the head of the script file */
struct script_bin_head {
int32_t sections;
int32_t version[3];
uint32_t sections;
uint32_t version[3];
struct script_bin_section section[];
};