diff options
Diffstat (limited to 'lib/header.c')
| -rw-r--r-- | lib/header.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/lib/header.c b/lib/header.c index 6e7b6b436..e423ad172 100644 --- a/lib/header.c +++ b/lib/header.c @@ -129,6 +129,13 @@ static const size_t headerMaxbytes = (256*1024*1024); #define hdrchkTag(_tag) ((_tag) < HEADER_I18NTABLE) /** + * Reasonableness check on count values. + * Catches nasty stuff like negative or zero counts, which would cause + * integer underflows in strtaglen(). + */ +#define hdrchkCount(_count) ((_count) == 0) + +/** * Sanity check on type values. */ #define hdrchkType(_type) ((_type) < RPM_MIN_TYPE || (_type) > RPM_MAX_TYPE) @@ -279,6 +286,8 @@ static rpmRC hdrblobVerifyInfo(hdrblob blob, char **emsg) goto err; if (hdrchkType(info.type)) goto err; + if (hdrchkCount(info.count)) + goto err; if (hdrchkAlign(info.type, info.offset)) goto err; if (hdrchkRange(blob->dl, info.offset)) |