libpst: src/lzfu.c annotate

annotate src/lzfu.c @ 41:183ae993b9ad

security fix for potential buffer overrun in lz decompress

author	carl
date	Tue, 02 Oct 2007 15:49:44 -0700
parents	ddfb25318812
children	f6db1f060a95

rev	line source
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	1 /*
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	2 This program is free software; you can redistribute it and/or modify
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	3 it under the terms of the GNU General Public License as published by
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	4 the Free Software Foundation; either version 2 of the License, or
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	5 (at your option) any later version.
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	6
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	7 You should have received a copy of the GNU General Public License
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	8 along with this program; if not, write to the Free Software Foundation,
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	9 Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	10 */
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	11
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	12 #include "define.h"
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	13 #include "libpst.h"
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	14 #include <sys/types.h>
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	15 #include <string.h>
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	16 #include <stdio.h>
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	17
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	18 #include "lzfu.h"
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	19
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	20 #define LZFU_COMPRESSED 0x75465a4c
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	21 #define LZFU_UNCOMPRESSED 0x414c454d
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	22
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	23 // initital dictionary
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	24 #define LZFU_INITDICT "{\\rtf1\\ansi\\mac\\deff0\\deftab720{\\fonttbl;}" \
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	25 "{\\f0\\fnil \\froman \\fswiss \\fmodern \\fscrip" \
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	26 "t \\fdecor MS Sans SerifSymbolArialTimes Ne" \
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	27 "w RomanCourier{\\colortbl\\red0\\green0\\blue0" \
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	28 "\r\n\\par \\pard\\plain\\f0\\fs20\\b\\i\\u\\tab" \
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	29 "\\tx"
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	30 // initial length of dictionary
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	31 #define LZFU_INITLENGTH 207
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	32
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	33 // header for compressed rtf
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	34 typedef struct _lzfuheader {
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	35 u_int32_t cbSize;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	36 u_int32_t cbRawSize;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	37 u_int32_t dwMagic;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	38 u_int32_t dwCRC;
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	39 } lzfuheader;
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	40
c508ee15dfca switch to automake/autoconf carl parents: diff changeset	41
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	42 unsigned char* lzfu_decompress (unsigned char* rtfcomp, u_int32_t compsize, size_t *size) {
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	43 // the dictionary buffer
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	44 unsigned char dict[4096];
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	45 // the dictionary pointer
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	46 unsigned int dict_length=0;
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	47 // the header of the lzfu block
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	48 lzfuheader lzfuhdr;
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	49 // container for the data blocks
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	50 unsigned char flags;
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	51 // temp value for determining the bits in the flag
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	52 unsigned char flag_mask;
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	53 u_int32_t i;
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	54 unsigned char *out_buf;
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	55 u_int32_t out_ptr = 0;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	56 u_int32_t out_size;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	57 u_int32_t in_ptr;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	58 u_int32_t in_size;
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	59
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	60 memcpy(dict, LZFU_INITDICT, LZFU_INITLENGTH);
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	61 dict_length = LZFU_INITLENGTH;
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	62 memcpy(&lzfuhdr, rtfcomp, sizeof(lzfuhdr));
37 ddfb25318812 more valgrind fixes carl parents: 36 diff changeset	63 LE32_CPU(lzfuhdr.cbSize);
ddfb25318812 more valgrind fixes carl parents: 36 diff changeset	64 LE32_CPU(lzfuhdr.cbRawSize);
ddfb25318812 more valgrind fixes carl parents: 36 diff changeset	65 LE32_CPU(lzfuhdr.dwMagic);
ddfb25318812 more valgrind fixes carl parents: 36 diff changeset	66 LE32_CPU(lzfuhdr.dwCRC);
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	67 //printf("total size: %d\n", lzfuhdr.cbSize+4);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	68 //printf("raw size : %d\n", lzfuhdr.cbRawSize);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	69 //printf("compressed: %s\n", (lzfuhdr.dwMagic == LZFU_COMPRESSED ? "yes" : "no"));
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	70 //printf("CRC : %#x\n", lzfuhdr.dwCRC);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	71 //printf("\n");
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	72 out_size = lzfuhdr.cbRawSize + 3; // two braces and a null terminator
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	73 out_buf = (unsigned char*)xmalloc(out_size);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	74 in_ptr = sizeof(lzfuhdr);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	75 in_size = (lzfuhdr.cbSize < compsize) ? lzfuhdr.cbSize : compsize;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	76 while (in_ptr < in_size) {
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	77 flags = rtfcomp[in_ptr++];
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	78 flag_mask = 1;
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	79 while (flag_mask) {
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	80 if (flag_mask & flags) {
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	81 // two bytes available?
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	82 if (in_ptr+1 < in_size) {
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	83 // read 2 bytes from input
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	84 unsigned short int blkhdr, offset, length;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	85 memcpy(&blkhdr, rtfcomp+in_ptr, 2);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	86 LE16_CPU(blkhdr);
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	87 in_ptr += 2;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	88 /* swap the upper and lower bytes of blkhdr */
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	89 blkhdr = (((blkhdr&0xFF00)>>8)+
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	90 ((blkhdr&0x00FF)<<8));
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	91 /* the offset is the first 12 bits of the 16 bit value */
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	92 offset = (blkhdr&0xFFF0)>>4;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	93 /* the length of the dict entry are the last 4 bits */
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	94 length = (blkhdr&0x000F)+2;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	95 // add the value we are about to print to the dictionary
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	96 for (i=0; i < length; i++) {
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	97 unsigned char c1;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	98 c1 = dict[(offset+i)%4096];
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	99 dict[dict_length]=c1;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	100 dict_length = (dict_length+1) % 4096;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	101 if (out_ptr < out_size) out_buf[out_ptr++] = c1;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	102 }
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	103 }
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	104 } else {
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	105 // one byte available?
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	106 if (in_ptr < in_size) {
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	107 // uncompressed chunk (single byte)
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	108 char c1 = rtfcomp[in_ptr++];
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	109 dict[dict_length] = c1;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	110 dict_length = (dict_length+1)%4096;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	111 if (out_ptr < out_size) out_buf[out_ptr++] = c1;
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	112 }
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	113 }
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	114 flag_mask <<= 1;
6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	115 }
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	116 }
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	117 // the compressed version doesn't appear to drop the closing
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	118 // braces onto the doc, so we do that here.
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	119 if (out_ptr < out_size) out_buf[out_ptr++] = '}';
183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	120 if (out_ptr < out_size) out_buf[out_ptr++] = '}';
37 ddfb25318812 more valgrind fixes carl parents: 36 diff changeset	121 *size = out_ptr;
41 183ae993b9ad security fix for potential buffer overrun in lz decompress carl parents: 37 diff changeset	122 if (out_ptr < out_size) out_buf[out_ptr++] = '\0';
36 6fe121a971c9 valgrind fixes carl parents: 16 diff changeset	123 return out_buf;
16 c508ee15dfca switch to automake/autoconf carl parents: diff changeset	124 }

Mercurial > libpst

annotate src/lzfu.c @ 41:183ae993b9ad