summaryrefslogtreecommitdiffstatshomepage
path: root/src/lib
diff options
context:
space:
mode:
author Dirk Best <mail@dirk-best.de>2018-01-28 01:52:55 +0100
committer Dirk Best <mail@dirk-best.de>2018-01-28 01:54:49 +0100
commit648af3b4d9a49f8a3cfcdbf05c9f37624846fc6e (patch)
tree172f013dcb405b117d37cf5e19c6c3932fcd1af1 /src/lib
parent13efc263fd5d40a712972e23b352e56fb0fcf422 (diff)
d88_dsk: Add some safety checks to avoid reading beyond the end of file
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/formats/d88_dsk.cpp11
1 files changed, 10 insertions, 1 deletions
diff --git a/src/lib/formats/d88_dsk.cpp b/src/lib/formats/d88_dsk.cpp
index cc95dcedb69..1f999882aed 100644
--- a/src/lib/formats/d88_dsk.cpp
+++ b/src/lib/formats/d88_dsk.cpp
@@ -479,22 +479,31 @@ bool d88_format::load(io_generic *io, uint32_t form_factor, floppy_image *image)
uint32_t track_pos[164];
io_generic_read(io, track_pos, 32, 164*4);
+ uint64_t file_size = io_generic_size(io);
+
for(int track=0; track < track_count; track++)
for(int head=0; head < head_count; head++) {
int pos = little_endianize_int32(track_pos[track * head_count + head]);
if(!pos)
continue;
-
desc_pc_sector sects[256];
uint8_t sect_data[65536];
int sdatapos = 0;
int sector_count = 1;
for(int i=0; i<sector_count; i++) {
+
+ if (pos + 16 > file_size)
+ return true;
+
uint8_t hs[16];
io_generic_read(io, hs, pos, 16);
pos += 16;
uint16_t size = little_endianize_int16(*(uint16_t *)(hs+14));
+
+ if(pos + size > file_size)
+ return true;
+
if(i == 0) {
sector_count = little_endianize_int16(*(uint16_t *)(hs+4));
// Support broken vfman converter