From efbe570f27cf3913a739494990537de02a45a7d9 Mon Sep 17 00:00:00 2001 From: olszomal Date: Thu, 12 Jan 2023 12:28:52 +0100 Subject: [PATCH] Fix out-of-bounds read, CID 1519383 --- msi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/msi.c b/msi.c index eda3a13..ea30d20 100644 --- a/msi.c +++ b/msi.c @@ -319,7 +319,8 @@ static MSI_ENTRY *parse_entry(MSI_FILE *msi, const u_char *data, int is_root) memcpy(entry->name, data + DIRENT_NAME, entry->nameLen); /* The root directory entry's Name field MUST contain the null-terminated * string "Root Entry" in Unicode UTF-16. */ - if (is_root && memcmp(entry->name, msi_root_entry, entry->nameLen)) { + if (is_root && (entry->nameLen != sizeof msi_root_entry + || memcmp(entry->name, msi_root_entry, entry->nameLen))) { printf("Corrupted Root Directory Entry's Name\n"); OPENSSL_free(entry); return NULL; /* FAILED */