From 648af3b4d9a49f8a3cfcdbf05c9f37624846fc6e Mon Sep 17 00:00:00 2001 From: Dirk Best Date: Sun, 28 Jan 2018 01:52:55 +0100 Subject: d88_dsk: Add some safety checks to avoid reading beyond the end of file --- src/lib/formats/d88_dsk.cpp | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/lib/formats/d88_dsk.cpp b/src/lib/formats/d88_dsk.cpp index cc95dcedb69..1f999882aed 100644 --- a/src/lib/formats/d88_dsk.cpp +++ b/src/lib/formats/d88_dsk.cpp @@ -479,22 +479,31 @@ bool d88_format::load(io_generic *io, uint32_t form_factor, floppy_image *image) uint32_t track_pos[164]; io_generic_read(io, track_pos, 32, 164*4); + uint64_t file_size = io_generic_size(io); + for(int track=0; track < track_count; track++) for(int head=0; head < head_count; head++) { int pos = little_endianize_int32(track_pos[track * head_count + head]); if(!pos) continue; - desc_pc_sector sects[256]; uint8_t sect_data[65536]; int sdatapos = 0; int sector_count = 1; for(int i=0; i file_size) + return true; + uint8_t hs[16]; io_generic_read(io, hs, pos, 16); pos += 16; uint16_t size = little_endianize_int16(*(uint16_t *)(hs+14)); + + if(pos + size > file_size) + return true; + if(i == 0) { sector_count = little_endianize_int16(*(uint16_t *)(hs+4)); // Support broken vfman converter -- cgit v1.2.3