From 83ce7dc62f23e26e168ecad878402ce4a844c997 Mon Sep 17 00:00:00 2001 From: John Reiser Date: Sat, 9 May 2015 17:47:17 -0700 Subject: [PATCH] Must not compare orig_file_size with fi->st_size() during ::unpack --- src/p_lx_elf.cpp | 6 ++---- src/p_unix.cpp | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp index b307c738..840f4938 100644 --- a/src/p_lx_elf.cpp +++ b/src/p_lx_elf.cpp @@ -3014,8 +3014,7 @@ void PackLinuxElf64::unpack(OutputFile *fo) p_info hbuf; fi->readx(&hbuf, sizeof(hbuf)); unsigned orig_file_size = get_te32(&hbuf.p_filesize); blocksize = get_te32(&hbuf.p_blocksize); - if (file_size > (off_t)orig_file_size || blocksize > orig_file_size - || orig_file_size > fi->st_size()) + if (file_size > (off_t)orig_file_size || blocksize > orig_file_size) throwCantUnpack("p_info corrupted"); ibuf.alloc(blocksize + OVERHEAD); @@ -3534,8 +3533,7 @@ void PackLinuxElf32::unpack(OutputFile *fo) p_info hbuf; fi->readx(&hbuf, sizeof(hbuf)); unsigned orig_file_size = get_te32(&hbuf.p_filesize); blocksize = get_te32(&hbuf.p_blocksize); - if (file_size > (off_t)orig_file_size || blocksize > orig_file_size - || orig_file_size > fi->st_size()) + if (file_size > (off_t)orig_file_size || blocksize > orig_file_size) throwCantUnpack("p_info corrupted"); ibuf.alloc(blocksize + OVERHEAD); diff --git a/src/p_unix.cpp b/src/p_unix.cpp index 32f94af7..6c831467 100644 --- a/src/p_unix.cpp +++ b/src/p_unix.cpp @@ -556,7 +556,7 @@ void PackUnix::unpack(OutputFile *fo) orig_file_size = get_te32(&hbuf.p_filesize); blocksize = get_te32(&hbuf.p_blocksize); - if (file_size != (off_t)orig_file_size || blocksize > orig_file_size) + if (file_size > (off_t)orig_file_size || blocksize > orig_file_size) throwCantUnpack("file header corrupted"); } else