diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/SBaseFileTable.cpp | 13 | ||||
| -rw-r--r-- | src/SFileOpenArchive.cpp | 7 |
2 files changed, 20 insertions, 0 deletions
diff --git a/src/SBaseFileTable.cpp b/src/SBaseFileTable.cpp index ed0748d..d822dc7 100644 --- a/src/SBaseFileTable.cpp +++ b/src/SBaseFileTable.cpp @@ -685,6 +685,12 @@ static TMPQHash * DefragmentHashTable( // Parse the hash table and move the entries to the begin of it
for(pSource = pHashTable; pSource < pHashTableEnd; pSource++)
{
+ // We need to mask out the upper 4 bits of the block table index.
+ // This is because it gets shifted out when calculating block table offset
+ // BlockTableOffset = pHash->dwBlockIndex * 0x10
+ // Malformed MPQ maps may contain invalid entries
+ pSource->dwBlockIndex &= 0x0FFFFFFF;
+
// Check whether this is a valid hash table entry
if(IsValidHashEntry1(ha, pSource, pBlockTable))
{
@@ -768,6 +774,12 @@ static int BuildFileTableFromBlockTable( DWORD dwBlockIndex = pHash->dwBlockIndex;
DWORD dwNewIndex = pHash->dwBlockIndex;
+ // We need to mask out the upper 4 bits of the block table index.
+ // This is because it gets shifted out when calculating block table offset
+ // BlockTableOffset = pHash->dwBlockIndex * 0x10
+ // Malformed MPQ maps may contain invalid entries
+ pHash->dwBlockIndex &= 0x0FFFFFFF;
+
//
// We need to properly handle these cases:
// - Multiple hash entries (same file name) point to the same block entry
@@ -776,6 +788,7 @@ static int BuildFileTableFromBlockTable( // Ignore all hash table entries where:
// - dwBlockIndex >= BlockTableSize
// - Flags of the appropriate block table entry
+ //
if(IsValidHashEntry1(ha, pHash, pBlockTable))
{
diff --git a/src/SFileOpenArchive.cpp b/src/SFileOpenArchive.cpp index f9469fb..6a249f2 100644 --- a/src/SFileOpenArchive.cpp +++ b/src/SFileOpenArchive.cpp @@ -365,6 +365,13 @@ bool WINAPI SFileOpenArchive( ha->pUserData = NULL; } + // Anti-overflow. If the hash table size in the header is + // higher than 0x10000000, it would overflow in 32-bit version + // Observed in the malformed Warcraft III maps + // Example map: MPQ_2016_v1_ProtectedMap_TableSizeOverflow.w3x + ha->pHeader->dwHashTableSize &= 0x0FFFFFFF; + ha->pHeader->dwBlockTableSize &= 0x0FFFFFFF; + // Both MPQ_OPEN_NO_LISTFILE or MPQ_OPEN_NO_ATTRIBUTES trigger read only mode if(dwFlags & (MPQ_OPEN_NO_LISTFILE | MPQ_OPEN_NO_ATTRIBUTES)) ha->dwFlags |= MPQ_FLAG_READ_ONLY; |