[src/trunk]: src/dist/bzip2 avoid integer overflow that can lead to buffer ov...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/152d13385942
branches:  trunk
changeset: 757750:152d13385942
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Sep 20 19:39:20 2010 +0000

description:
avoid integer overflow that can lead to buffer overflow

diffstat:

 dist/bzip2/decompress.c |  7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diffs (17 lines):

diff -r bc06742f5855 -r 152d13385942 dist/bzip2/decompress.c
--- a/dist/bzip2/decompress.c   Mon Sep 20 17:51:38 2010 +0000
+++ b/dist/bzip2/decompress.c   Mon Sep 20 19:39:20 2010 +0000
@@ -381,6 +381,13 @@
             es = -1;
             N = 1;
             do {
+               /* Check that N doesn't get too big, so that es doesn't
+                  go negative.  The maximum value that can be
+                  RUNA/RUNB encoded is equal to the block size (post
+                  the initial RLE), viz, 900k, so bounding N at 2
+                  million should guard against overflow without
+                  rejecting any legitimate inputs. */
+               if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
                if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
                if (nextSym == BZ_RUNB) es = es + (1+1) * N;
                N = N * 2;