diff options
author | Nathan Woods <npwoods@mess.org> | 2016-09-13 06:50:08 -0400 |
---|---|---|
committer | Nathan Woods <npwoods@mess.org> | 2016-09-13 06:50:08 -0400 |
commit | c51de7aa95ac1028fb4c7c0a28c40e50e2b2d9bf (patch) | |
tree | f02f5b0dae7fe5bb876b994e29d2a8c9f25959d8 /src/lib | |
parent | 9b88a353ba4ed32725ec747457cd958dc7ab2bfa (diff) |
Fixed a potential buffer overrun in the code that reads headers for the CoCo JVC disk image format
Diffstat (limited to 'src/lib')
-rw-r--r-- | src/lib/formats/jvc_dsk.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/lib/formats/jvc_dsk.cpp b/src/lib/formats/jvc_dsk.cpp index 30ec8287f22..ce364d9efe2 100644 --- a/src/lib/formats/jvc_dsk.cpp +++ b/src/lib/formats/jvc_dsk.cpp @@ -37,16 +37,19 @@ const char *jvc_format::extensions() const bool jvc_format::parse_header(io_generic *io, int &header_size, int &tracks, int &heads, int §ors, int §or_size, int &base_sector_id) { + // The JVC format has a header whose size is the size of the image modulo 256. Currently, we only + // handle up to five header bytes UINT64 size = io_generic_size(io); header_size = size % 256; UINT8 header[5]; + // if we know that this is a header of a bad size, we can fail + // immediately; otherwise read the header + if (header_size >= sizeof(header)) + return false; if (header_size > 0) io_generic_read(io, header, 0, header_size); - if (header_size > 5) - return false; - // default values heads = 1; sectors = 18; |