Fix: buffer overflow (CVE-2018-11724)

bfabiszewski · Jun 20, 2018 · b5657d7 · b5657d7
1 parent c625698
commit b5657d7
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/util.c b/src/util.c
@@ -1717,6 +1717,12 @@ static MOBI_RET mobi_decompress_content(const MOBIData *m, char *text, FILE *fil
                 }
             }
             const size_t decrypt_size = curr->size - extra_size;
+            if (decrypt_size > decompressed_size) {
+                debug_print("Record too large: %zu\n", decrypt_size);
+                mobi_free_huffcdic(huffcdic);
+                free(decompressed);
+                return MOBI_DATA_CORRUPT;
+            }
             if (decrypt_size) {
                 ret = mobi_drm_decrypt_buffer(decompressed, curr->data, decrypt_size, m);
                 if (ret != MOBI_SUCCESS) {