sassoftware / relic

Relic is a service and a tool for adding digital signatures to operating system packages for Linux and Windows
Apache License 2.0
151 stars 41 forks source link

comdoc panic: runtime error: index out of range [-2] #30

Closed gabriel-vasile closed 1 year ago

gabriel-vasile commented 1 year ago
package main

import (
    "io"
    "net/http"
    "os"

    "github.com/sassoftware/relic/v7/lib/comdoc"
)

func main() {
    f, err := os.CreateTemp("", "")
    if err != nil {
        panic(err)
    }
    resp, err := http.Get("https://github.com/decalage2/oletools/raw/master/tests/test-data/encrypted/dde-test-encrypt-standardpassword.xls")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()
    if _, err := io.Copy(f, resp.Body); err != nil {
        panic(err)
    }

    doc, err := comdoc.WriteFile(f)
    if err != nil {
        panic(err)
    }

    var b [10000]byte
    if err := doc.AddFile("file", b[:]); err != nil {
        panic(err)
    }
    if err := doc.Close(); err != nil {
        panic(err)
    }
}
➜  asd git:(master) ✗ go run main.go
panic: runtime error: index out of range [-2]

goroutine 1 [running]:
github.com/sassoftware/relic/v7/lib/comdoc.freeSectors(...)
    /Users/gabriel.vasile/go/1.20.3/pkg/mod/github.com/sassoftware/relic/v7@v7.5.5/lib/comdoc/sectors.go:71
github.com/sassoftware/relic/v7/lib/comdoc.(*ComDoc).writeShortSAT(0x4?)
    /Users/gabriel.vasile/go/1.20.3/pkg/mod/github.com/sassoftware/relic/v7@v7.5.5/lib/comdoc/shortsector.go:51 +0x2e8
github.com/sassoftware/relic/v7/lib/comdoc.(*ComDoc).Close(0x1400006c000)
    /Users/gabriel.vasile/go/1.20.3/pkg/mod/github.com/sassoftware/relic/v7@v7.5.5/lib/comdoc/writer.go:87 +0x80
main.main()
    /Users/gabriel.vasile/tmp/comdocf/asd/main.go:34 +0x188
exit status 2
mtharp commented 1 year ago

relic's comdoc package really only supports MSI files, and even then just the bare minimum to store and validate signatures. I'm happy to accept pull requests if they don't interfere with the main functionality but unfortunately I don't have time to chase down issues myself, sorry!