Commit ef545814 authored by Bernhard Nortmann's avatar Bernhard Nortmann
Browse files

fexc: Improve script_decompile_bin() safeguards



When declaring 'signed' values for section count and version
information in the script_bin_head structure, testing them to be
below certain thresholds (SCRIPT_BIN_*_LIMIT) is insufficient;
as 'negative' values like in "fexc-bin: script.bin: version:
-404840454.-1074397186.-1073906177" would still pass.

Fix this by making these member fields unsigned.
Signed-off-by: default avatarBernhard Nortmann <bernhard.nortmann@web.de>
parent a8054dfa
...@@ -312,17 +312,16 @@ int script_decompile_bin(void *bin, size_t bin_size, ...@@ -312,17 +312,16 @@ int script_decompile_bin(void *bin, size_t bin_size,
const char *filename, const char *filename,
struct script *script) struct script *script)
{ {
int i; unsigned int i;
struct script_bin_head *head = bin; struct script_bin_head *head = bin;
pr_info("%s: version: %d.%d.%d\n", filename, pr_info("%s: version: %u.%u.%u\n", filename,
head->version[0], head->version[1], head->version[0], head->version[1], head->version[2]);
head->version[2]); pr_info("%s: size: %zu (%u sections)\n", filename,
pr_info("%s: size: %zu (%d sections)\n", filename,
bin_size, head->sections); bin_size, head->sections);
if (head->sections > SCRIPT_BIN_SECTION_LIMIT) { if (head->sections > SCRIPT_BIN_SECTION_LIMIT) {
pr_err("Malformed data: too many sections (%d).\n", pr_err("Malformed data: too many sections (%u).\n",
head->sections); head->sections);
return 0; return 0;
} }
...@@ -330,7 +329,7 @@ int script_decompile_bin(void *bin, size_t bin_size, ...@@ -330,7 +329,7 @@ int script_decompile_bin(void *bin, size_t bin_size,
if ((head->version[0] > SCRIPT_BIN_VERSION_LIMIT) || if ((head->version[0] > SCRIPT_BIN_VERSION_LIMIT) ||
(head->version[1] > SCRIPT_BIN_VERSION_LIMIT) || (head->version[1] > SCRIPT_BIN_VERSION_LIMIT) ||
(head->version[2] > SCRIPT_BIN_VERSION_LIMIT)) { (head->version[2] > SCRIPT_BIN_VERSION_LIMIT)) {
pr_err("Malformed data: version %d.%d.%d.\n", pr_err("Malformed data: version %u.%u.%u.\n",
head->version[0], head->version[1], head->version[2]); head->version[0], head->version[1], head->version[2]);
return 0; return 0;
} }
......
...@@ -26,8 +26,8 @@ struct script_bin_section { ...@@ -26,8 +26,8 @@ struct script_bin_section {
/** binary representation of the head of the script file */ /** binary representation of the head of the script file */
struct script_bin_head { struct script_bin_head {
int32_t sections; uint32_t sections;
int32_t version[3]; uint32_t version[3];
struct script_bin_section section[]; struct script_bin_section section[];
}; };
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment