X-Git-Url: http://shamusworld.gotdns.org/cgi-bin/gitweb.cgi?p=rmac;a=blobdiff_plain;f=direct.c;fp=direct.c;h=684607f522ad6456f004032e9fe0c936c4826e33;hp=24c3d93d4f1d029941c600019861fc908ff3cdd7;hb=c6808e75ed6088e3006c0d6748c1288eebb39c8a;hpb=45c9dc23612600f6156009e2e9c0039a61b64ea2 diff --git a/direct.c b/direct.c index 24c3d93..684607f 100644 --- a/direct.c +++ b/direct.c @@ -628,11 +628,13 @@ allright: { // Parse size and position parameters uint64_t requested_size = -1; // -1 means "not set" for these two + if (*tok++ != ',') { close(fd); return error("expected comma after incbin filename"); } + if (tok != EOL) { if (*tok != ',') @@ -642,12 +644,14 @@ allright: close(fd); return ERROR; } + if ((int64_t)requested_size <= 0 || requested_size > size) { close(fd); return error("invalid incbin size requested"); } } + if (*tok != EOL) { if (*tok++ != ',') @@ -655,6 +659,7 @@ allright: close(fd); return error("expected comma after size parameter"); } + if (*tok != EOL) { if (abs_expr(&pos) != OK) @@ -662,6 +667,7 @@ allright: close(fd); return ERROR; } + if ((int64_t)pos <= 0 || pos > size) { close(fd); @@ -682,7 +688,7 @@ allright: { requested_size = size - pos; } - + // Are we going to read past the end of the file? if (pos + requested_size > size) { @@ -1215,7 +1221,7 @@ int d_ds(WORD siz) if (expr(exprbuf, &eval, &eattr, NULL) < 0) return ERROR; - + // Check to see if the value being passed in is negative (who the hell does // that?--nobody does; it's the code gremlins, or rum, what does it) // N.B.: Since 'eval' is of type uint64_t, if it goes negative, it will