From 99462cac1c6581bce36fe17fd1f430cbe114f0af Mon Sep 17 00:00:00 2001 From: Valentin Lefebvre Date: Wed, 20 Sep 2023 12:04:56 +0200 Subject: [PATCH] mmappend.c: pre-check header trailer magic * Avoid potential ASAN:SIGSEGV invalid memory access by pre-check the header trailer magic. * CVE-2020-18770 Signed-off-by: Valentin Lefebvre --- zzip/mmapped.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/zzip/mmapped.c b/zzip/mmapped.c index 8af18f4..49990e6 100644 --- a/zzip/mmapped.c +++ b/zzip/mmapped.c @@ -269,7 +269,9 @@ zzip_disk_entry_to_file_header(ZZIP_DISK * disk, struct zzip_disk_entry *entry) return 0; } ___ struct zzip_file_header *file_header = (void *) ptr; - if (zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) + if (file_header != 'P' || /* quick pre-check for trailer magic */ + zzip_file_header_get_magic(file_header) != ZZIP_FILE_HEADER_MAGIC) + { errno = EBADMSG; return 0; -- 2.40.1