From 8d1b696b5575cc3417145da2075f6cf7e7337099 Mon Sep 17 00:00:00 2001 From: Albert Astals Cid Date: Tue, 28 May 2019 19:35:18 +0200 Subject: [PATCH] lib: bzip2: Make sure nSelectors is not out of range nSelectors is used in a loop from 0 to nSelectors to access selectorMtf which is UChar selectorMtf[BZ_MAX_SELECTORS]; so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid memory access Fixes out of bounds access discovered while fuzzying karchive This was reported as CVE-2019-12900 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Change-Id: I536d2fe19d7182d4e51f76a502e8f0e72a2359ea Signed-off-by: Md Sadre Alam --- lib/bzip2/bzlib_decompress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bzip2/bzlib_decompress.c b/lib/bzip2/bzlib_decompress.c index 4412b8a23e..513ae8cbb7 100644 --- a/lib/bzip2/bzlib_decompress.c +++ b/lib/bzip2/bzlib_decompress.c @@ -330,7 +330,7 @@ Int32 BZ2_decompress ( DState* s ) GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR); GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); - if (nSelectors < 1) RETURN(BZ_DATA_ERROR); + if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); for (i = 0; i < nSelectors; i++) { j = 0; while (True) {