Added checks in mach parser & fix radareorg#2465

alvarofe · May 1, 2015 · d920e09 · d920e09
1 parent 40d6df7
commit d920e09
Show file tree

Hide file tree

Showing 2 changed files with 161 additions and 24 deletions.
diff --git a/libr/bin/format/mach0/fatmach0.c b/libr/bin/format/mach0/fatmach0.c
@@ -7,7 +7,7 @@
 
 static int r_bin_fatmach0_init(struct r_bin_fatmach0_obj_t* bin) {
 	int len = r_buf_fread_at (bin->b, 0, (ut8*)&bin->hdr, "2I", 1);
-	if (len == -1) {
+	if (len == 0 || len == -1) {
 		perror ("read (fat_header)");
 		return R_FALSE;
 	}
@@ -19,8 +19,9 @@ static int r_bin_fatmach0_init(struct r_bin_fatmach0_obj_t* bin) {
 		return R_FALSE;
 	}
 	len = r_buf_fread_at (bin->b, R_BUF_CUR, (ut8*)bin->archs, "5I", bin->nfat_arch);
-	if (len == -1) {
+	if (len == 0 || len == -1) {
 		perror ("read (fat_arch)");
+		R_FREE (bin->archs);
 		return R_FALSE;
 	}
 	return R_TRUE;
@@ -30,9 +31,14 @@ struct r_bin_fatmach0_arch_t *r_bin_fatmach0_extract(struct r_bin_fatmach0_obj_t
 	struct r_bin_fatmach0_arch_t *ret;
 	ut8 *buf = NULL;
 
-	if (!bin || (idx < 0) || (idx > bin->hdr.nfat_arch))
+	if (!bin || (idx < 0) || (idx > bin->nfat_arch))
 		return NULL;
-	if (narch) *narch = bin->hdr.nfat_arch;
+
+	if (bin->archs[idx].offset > bin->size ||\
+	  bin->archs[idx].offset + bin->archs[idx].size > bin->size)
+		return NULL;
+
+	if (narch) *narch = bin->nfat_arch;
 	if (!(ret = R_NEW0 (struct r_bin_fatmach0_arch_t))) {
 		perror ("malloc (ret)");
 		return NULL;