Detect too long compressed integers which result in integer overflows.
MODIFY
src/reader_lcf.cpp
src/reader_lcf.cpp
@@ -87,7 +87,7 @@ void LcfReader::Read<uint32_t>(uint32_t& ref) {
int LcfReader::ReadInt() {
int value = 0;
unsigned char temp = 0;
-
+ int loops = 0;
do {
value <<= 7;
if (Read0(&temp, 1, 1) == 0) {
@@ -95,8 +95,14 @@ int LcfReader::ReadInt() {
return 0;
}
value |= temp & 0x7F;
+
+ if (loops > 5) {
+ fprintf(stderr, "Invalid compressed integer at %d\n", Tell());
+ }
+ ++loops;
} while (temp & 0x80);
- return value;
+
+ return loops > 5 ? 0 : value;
}
template <>
@@ -226,6 +232,9 @@ void LcfReader::SkipDebug(const struct LcfReader::Chunk& chunk_info, const char*
if ((i+1) % 16 == 0) {
fprintf(stderr, "\n");
}
+ if (Eof()) {
+ break;
+ }
}
fprintf(stderr, "\n");
}

Detect too long compressed integers which result in integer overflows.