diff options
author | 2018-01-28 01:52:55 +0100 | |
---|---|---|
committer | 2018-01-28 01:54:49 +0100 | |
commit | 648af3b4d9a49f8a3cfcdbf05c9f37624846fc6e (patch) | |
tree | 172f013dcb405b117d37cf5e19c6c3932fcd1af1 | |
parent | 13efc263fd5d40a712972e23b352e56fb0fcf422 (diff) |
d88_dsk: Add some safety checks to avoid reading beyond the end of file
-rw-r--r-- | src/lib/formats/d88_dsk.cpp | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/lib/formats/d88_dsk.cpp b/src/lib/formats/d88_dsk.cpp index cc95dcedb69..1f999882aed 100644 --- a/src/lib/formats/d88_dsk.cpp +++ b/src/lib/formats/d88_dsk.cpp @@ -479,22 +479,31 @@ bool d88_format::load(io_generic *io, uint32_t form_factor, floppy_image *image) uint32_t track_pos[164]; io_generic_read(io, track_pos, 32, 164*4); + uint64_t file_size = io_generic_size(io); + for(int track=0; track < track_count; track++) for(int head=0; head < head_count; head++) { int pos = little_endianize_int32(track_pos[track * head_count + head]); if(!pos) continue; - desc_pc_sector sects[256]; uint8_t sect_data[65536]; int sdatapos = 0; int sector_count = 1; for(int i=0; i<sector_count; i++) { + + if (pos + 16 > file_size) + return true; + uint8_t hs[16]; io_generic_read(io, hs, pos, 16); pos += 16; uint16_t size = little_endianize_int16(*(uint16_t *)(hs+14)); + + if(pos + size > file_size) + return true; + if(i == 0) { sector_count = little_endianize_int16(*(uint16_t *)(hs+4)); // Support broken vfman converter |