cgsecurity / testdisk

TestDisk & PhotoRec
https://www.cgsecurity.org/
GNU General Public License v2.0
1.58k stars 195 forks source link

Buffer size not checked before use in some header_check_x callbacks #39

Open gcembed opened 6 years ago

gcembed commented 6 years ago

For example, in file_prd.c, specific values are tested at fixed offset but buffer_size is not used to test if offset 0x17 is reachable.

static int header_check_prd(const unsigned char buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t file_recovery, file_recovery_t *file_recovery_new) { if( buffer[0x0d]!=0xdb || buffer[0x0e]!=0xe4 || buffer[0x0f]!=0x40 || buffer[0x15]!=0xdb || buffer[0x16]!=0xe4 || buffer[0x17]!=0x40) return 0; reset_file_recovery(file_recovery_new); file_recovery_new->extension=file_hint_prd.extension; return 1; }