Ubuntu
unrar-nonfree package

  1. Bug #84657 (rarcve)
  2. Comment #4

Comment 4 for bug 84657

Revision history for this message
Kees Cook (kees) wrote :

Seem the multi-byte actions should only happen if the entire range passes IS_VM_MEM()? Instead of:

+ if (IS_VM_MEM(Addr))
+ {
+ ((byte *)Addr)[0]=(byte)Value;
+ ((byte *)Addr)[1]=(byte)(Value>>8);
+ ((byte *)Addr)[2]=(byte)(Value>>16);
+ ((byte *)Addr)[3]=(byte)(Value>>24);

Does this make more sense:

+ if (IS_VM_MEM(Addr) &&
+ IS_VM_MEM(&((byte*)Addr[3]))
+ {
+ ((byte *)Addr)[0]=(byte)Value;
+ ((byte *)Addr)[1]=(byte)(Value>>8);
+ ((byte *)Addr)[2]=(byte)(Value>>16);
+ ((byte *)Addr)[3]=(byte)(Value>>24);