Mirror/StormLib
1
0
Fork 0
mirror of https://github.com/ladislav-zezula/StormLib.git synced 2026-01-21 15:14:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

+ Anti-integer overflow in calculating buffer for hash table, and position of the block table entry

Browse Source
This commit is contained in:
Ladislav Zezula
2016-01-28 08:56:48 +01:00
parent 7b7c9acce2
commit 7d65d87773
3 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/SFileOpenArchive.cpp
View File

@@ -365,6 +365,13 @@ bool WINAPI SFileOpenArchive(
ha->pUserData = NULL;
}
// Anti-overflow. If the hash table size in the header is
// higher than 0x10000000, it would overflow in 32-bit version
// Observed in the malformed Warcraft III maps
// Example map: MPQ_2016_v1_ProtectedMap_TableSizeOverflow.w3x
ha->pHeader->dwHashTableSize &= 0x0FFFFFFF;
ha->pHeader->dwBlockTableSize &= 0x0FFFFFFF;
// Both MPQ_OPEN_NO_LISTFILE or MPQ_OPEN_NO_ATTRIBUTES trigger read only mode
if(dwFlags & (MPQ_OPEN_NO_LISTFILE | MPQ_OPEN_NO_ATTRIBUTES))
ha->dwFlags |= MPQ_FLAG_READ_ONLY;