fix another invalid write and huge allocation

Yeraze · Feb 13, 2017 · 12326ac · 12326ac
1 parent e2d39bd
commit 12326ac
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/lib/ytnef.c b/lib/ytnef.c
@@ -22,6 +22,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include <limits.h>
 #include "ytnef.h"
 #include "tnef-errors.h"
 #include "mapi.h"
@@ -212,9 +213,13 @@ DDWORD SwapDDWord(BYTE *p, int size) {
 }
 
 /* convert 16-bit unicode to UTF8 unicode */
-char *to_utf8(int len, char *buf) {
+char *to_utf8(size_t len, char *buf) {
   int i, j = 0;
   /* worst case length */
+  if (len > 10000) {	// deal with this by adding an arbitrary limit
+     printf("corrupt file\n");
+     exit(-1);
+  }
   char *utf8 = malloc(3 * len / 2 + 1);
 
   for (i = 0; i < len - 1; i += 2) {

diff --git a/lib/ytnef.h b/lib/ytnef.h
@@ -44,7 +44,7 @@ variableLength *MAPIFindProperty(MAPIProps *p, unsigned int ID);
 int MAPISysTimetoDTR(BYTE *data, dtr *thedate);
 void MAPIPrint(MAPIProps *p);
 void TNEFPrintDate(dtr Date);
-char *to_utf8(int len, char *buf);
+char *to_utf8(size_t len, char *buf);
 WORD SwapWord(BYTE *p, int size);
 DWORD SwapDWord(BYTE *p, int size);
 DDWORD SwapDDWord(BYTE *p, int size);