Fix a buffer overflow bug in getbytes()

[lha/lha.git] / src / header.c

diff --git a/src/header.c b/src/header.c
index 0993b49..035d5d2 100644 (file)
--- a/src/header.c
+++ b/src/header.c
@@ -27,17 +27,16 @@
 #endif
 
 static char    *get_ptr;
-#define GET_BYTE()      (*get_ptr++ & 0xff)
+static char    *start_ptr;
+static off_t   storage_size;
+#define setup_get(PTR, SIZE)  (start_ptr = get_ptr = (PTR), storage_size = (SIZE))
 
 #if DUMP_HEADER
-static char    *start_ptr;
-#define setup_get(PTR)  (start_ptr = get_ptr = (PTR))
 #define get_byte()      dump_get_byte()
 #define skip_bytes(len) dump_skip_bytes(len)
 #else
-#define setup_get(PTR)  (get_ptr = (PTR))
-#define get_byte()      GET_BYTE()
-#define skip_bytes(len) (get_ptr += (len))
+#define get_byte()      _get_byte()
+#define skip_bytes(len) _skip_bytes(len)
 #endif
 #define put_ptr         get_ptr
 #define setup_put(PTR)  (put_ptr = (PTR))
@@ -68,6 +67,27 @@ calc_sum(p, len)
     return sum & 0xff;
 }
 
+static void
+_skip_bytes(len)
+{
+    if (len < 0) {
+      error("Invalid header: %d", len);
+      exit(1);
+    }
+    get_ptr += len;
+}
+
+static int
+_get_byte()
+{
+  if (get_ptr < start_ptr || get_ptr - start_ptr >= storage_size) {
+      error("Invalid header");
+      exit(1);
+  }
+
+  return (*get_ptr++ & 0xff);
+}
+
 #if DUMP_HEADER
 static int
 dump_get_byte()
@@ -76,7 +96,7 @@ dump_get_byte()
 
     if (verbose_listing && verbose > 1)
         printf("%02d %2d: ", get_ptr - start_ptr, 1);
-    c = GET_BYTE();
+    c = _get_byte();
     if (verbose_listing && verbose > 1) {
         if (isprint(c))
             printf("%d(0x%02x) '%c'\n", c, c, c);
@@ -93,12 +113,16 @@ dump_skip_bytes(len)
     if (len == 0) return;
     if (verbose_listing && verbose > 1) {
         printf("%02d %2d: ", get_ptr - start_ptr, len);
+        if (len < 0) {
+          error("Invalid header: %d", len);
+          exit(1);
+        }
         while (len--)
-            printf("0x%02x ", GET_BYTE());
+            printf("0x%02x ", _get_byte());
         printf("... ignored\n");
     }
     else
-        get_ptr += len;
+        _skip_bytes(len);
 }
 #endif
 
@@ -112,8 +136,8 @@ get_word()
     if (verbose_listing && verbose > 1)
         printf("%02d %2d: ", get_ptr - start_ptr, 2);
 #endif
-    b0 = GET_BYTE();
-    b1 = GET_BYTE();
+    b0 = _get_byte();
+    b1 = _get_byte();
     w = (b1 << 8) + b0;
 #if DUMP_HEADER
     if (verbose_listing && verbose > 1)
@@ -140,10 +164,10 @@ get_longword()
     if (verbose_listing && verbose > 1)
         printf("%02d %2d: ", get_ptr - start_ptr, 4);
 #endif
-    b0 = GET_BYTE();
-    b1 = GET_BYTE();
-    b2 = GET_BYTE();
-    b3 = GET_BYTE();
+    b0 = _get_byte();
+    b1 = _get_byte();
+    b2 = _get_byte();
+    b3 = _get_byte();
     l = (b3 << 24) + (b2 << 16) + (b1 << 8) + b0;
 #if DUMP_HEADER
     if (verbose_listing && verbose > 1)
@@ -172,14 +196,14 @@ get_longlongword()
     if (verbose_listing && verbose > 1)
         printf("%02d %2d: ", get_ptr - start_ptr, 4);
 #endif
-    b0 = GET_BYTE();
-    b1 = GET_BYTE();
-    b2 = GET_BYTE();
-    b3 = GET_BYTE();
-    b4 = GET_BYTE();
-    b5 = GET_BYTE();
-    b6 = GET_BYTE();
-    b7 = GET_BYTE();
+    b0 = _get_byte();
+    b1 = _get_byte();
+    b2 = _get_byte();
+    b3 = _get_byte();
+    b4 = _get_byte();
+    b5 = _get_byte();
+    b6 = _get_byte();
+    b7 = _get_byte();
 
     l = (b7 << 24) + (b6 << 16) + (b5 << 8) + b4;
     l <<= 32;
@@ -215,9 +239,13 @@ get_bytes(buf, len, size)
 #if DUMP_HEADER
     if (verbose_listing && verbose > 1)
         printf("%02d %2d: \"", get_ptr - start_ptr, len);
+    if (len < 0) {
+      error("Invalid header: %d", len);
+      exit(1);
+    }
 
-    for (i = 0; i < len; i++) {
-        if (i < size) buf[i] = get_ptr[i];
+    for (i = 0; i < len && i < size; i++) {
+        buf[i] = get_ptr[i];
 
         if (verbose_listing && verbose > 1) {
             if (isprint(buf[i]))
@@ -230,6 +258,10 @@ get_bytes(buf, len, size)
     if (verbose_listing && verbose > 1)
         printf("\"\n");
 #else
+    if (len < 0) {
+      error("Invalid header: %d", len);
+      exit(1);
+    }
     for (i = 0; i < len && i < size; i++)
         buf[i] = get_ptr[i];
 #endif
@@ -278,6 +310,7 @@ convert_filename(name, len, size,
         to_code_save = CODE_CAP;
         to_code = CODE_SJIS;
     }
+#endif
 
     /* special case: if `name' has small lettter, not convert case. */
     if (from_code == CODE_SJIS && case_to == TO_LOWER) {
@@ -294,6 +327,7 @@ convert_filename(name, len, size,
         }
     }
 
+#ifdef MULTIBYTE_FILENAME
     if (from_code == CODE_SJIS && to_code == CODE_UTF8) {
         for (i = 0; i < len; i++) {
             if (SJIS_FIRST_P(name[i]) && SJIS_SECOND_P(name[i+1]))
@@ -553,7 +587,7 @@ get_extended_header(fp, hdr, header_size, hcrc)
         if (verbose_listing && verbose > 1)
             printf("---\n");
 #endif
-        setup_get(data);
+        setup_get(data, sizeof(data));
         if (sizeof(data) < header_size) {
             error("header size (%ld) too large.", header_size);
             exit(1);
@@ -786,6 +820,7 @@ get_header_level0(fp, hdr, data)
     char *data;
 {
     size_t header_size;
+    ssize_t remain_size;
     ssize_t extend_size;
     int checksum;
     int name_length;
@@ -795,8 +830,14 @@ get_header_level0(fp, hdr, data)
     hdr->header_size = header_size = get_byte();
     checksum = get_byte();
 
-    if (fread(data + COMMON_HEADER_SIZE,
-              header_size + 2 - COMMON_HEADER_SIZE, 1, fp) == 0) {
+    /* The data variable has been already read as COMMON_HEADER_SIZE bytes.
+       So we must read the remaining header size by the header_size. */
+    remain_size = header_size + 2 - COMMON_HEADER_SIZE;
+    if (remain_size <= 0) {
+        error("Invalid header size (LHarc file ?)");
+        return FALSE;
+    }
+    if (fread(data + COMMON_HEADER_SIZE, remain_size, 1, fp) == 0) {
         error("Invalid header (LHarc file ?)");
         return FALSE;   /* finish */
     }
@@ -902,6 +943,7 @@ get_header_level1(fp, hdr, data)
     char *data;
 {
     size_t header_size;
+    ssize_t remain_size;
     ssize_t extend_size;
     int checksum;
     int name_length;
@@ -911,8 +953,14 @@ get_header_level1(fp, hdr, data)
     hdr->header_size = header_size = get_byte();
     checksum = get_byte();
 
-    if (fread(data + COMMON_HEADER_SIZE,
-              header_size + 2 - COMMON_HEADER_SIZE, 1, fp) == 0) {
+    /* The data variable has been already read as COMMON_HEADER_SIZE bytes.
+       So we must read the remaining header size by the header_size. */
+    remain_size = header_size + 2 - COMMON_HEADER_SIZE;
+    if (remain_size <= 0) {
+        error("Invalid header size (LHarc file ?)");
+        return FALSE;
+    }
+    if (fread(data + COMMON_HEADER_SIZE, remain_size, 1, fp) == 0) {
         error("Invalid header (LHarc file ?)");
         return FALSE;   /* finish */
     }
@@ -996,6 +1044,7 @@ get_header_level2(fp, hdr, data)
     char *data;
 {
     size_t header_size;
+    ssize_t remain_size;
     ssize_t extend_size;
     int padding;
     unsigned int hcrc;
@@ -1003,6 +1052,13 @@ get_header_level2(fp, hdr, data)
     hdr->size_field_length = 2; /* in bytes */
     hdr->header_size = header_size = get_word();
 
+    /* The data variable has been already read as COMMON_HEADER_SIZE bytes.
+       So we must read the remaining header size without ext-header. */
+    remain_size = header_size - I_LEVEL2_HEADER_SIZE;
+    if (remain_size < 0) {
+        error("Invalid header size (LHarc file ?)");
+        return FALSE;
+    }
     if (fread(data + COMMON_HEADER_SIZE,
               I_LEVEL2_HEADER_SIZE - COMMON_HEADER_SIZE, 1, fp) == 0) {
         error("Invalid header (LHarc file ?)");
@@ -1034,7 +1090,12 @@ get_header_level2(fp, hdr, data)
         return FALSE;
 
     padding = header_size - I_LEVEL2_HEADER_SIZE - extend_size;
-    while (padding--)           /* padding should be 0 or 1 */
+    /* padding should be 0 or 1 */
+    if (padding != 0 && padding != 1) {
+        error("Invalid header size (padding: %d)", padding);
+        return FALSE;
+    }
+    while (padding--)
         hcrc = UPDATE_CRC(hcrc, fgetc(fp));
 
     if (hdr->header_crc != hcrc)
@@ -1077,6 +1138,7 @@ get_header_level3(fp, hdr, data)
     char *data;
 {
     size_t header_size;
+    ssize_t remain_size;
     ssize_t extend_size;
     int padding;
     unsigned int hcrc;
@@ -1105,6 +1167,11 @@ get_header_level3(fp, hdr, data)
     hdr->crc = get_word();
     hdr->extend_type = get_byte();
     hdr->header_size = header_size = get_longword();
+    remain_size = header_size - I_LEVEL3_HEADER_SIZE;
+    if (remain_size < 0) {
+        error("Invalid header size (LHarc file ?)");
+        return FALSE;
+    }
     extend_size = get_longword();
 
     INITIALIZE_CRC(hcrc);
@@ -1114,9 +1181,12 @@ get_header_level3(fp, hdr, data)
     if (extend_size == -1)
         return FALSE;
 
-    padding = header_size - I_LEVEL3_HEADER_SIZE - extend_size;
-    while (padding--)           /* padding should be 0 */
-        hcrc = UPDATE_CRC(hcrc, fgetc(fp));
+    padding = remain_size - extend_size;
+    /* padding should be 0 */
+    if (padding != 0) {
+        error("Invalid header size (padding: %d)", padding);
+        return FALSE;
+    }
 
     if (hdr->header_crc != hcrc)
         error("header CRC error");
@@ -1141,7 +1211,7 @@ get_header(fp, hdr)
 
     memset(hdr, 0, sizeof(LzHeader));
 
-    setup_get(data);
+    setup_get(data, sizeof(data));
 
     if ((end_mark = getc(fp)) == EOF || end_mark == 0) {
         return FALSE;           /* finish */
@@ -2017,9 +2087,9 @@ utf8_to_sjis(char *dst, const char *src, size_t dstsize)
 }
 
 /*
- * SJIS <-> EUC ÊÑ´¹´Ø¿ô
- * ¡ÖÆüËܸì¾ðÊó½èÍý¡×   ¥½¥Õ¥È¥Ð¥ó¥¯(³ô)
- *  ¤è¤êÈ´¿è(by Koji Arai)
+ * SJIS <-> EUC 変換関数
+ * 「日本語情報処理」   ソフトバンク(株)
+ *  より抜粋(by Koji Arai)
  */
 void
 euc2sjis(int *p1, int *p2)