Prevent huge memory allocations from fuzzed header fields

[wimlib] / src / update_image.c

diff --git a/src/update_image.c b/src/update_image.c
index 334db3862e526ec2294b9d636fe3a58aad5a2992..2964b71778f49099da55ceaa991be2fdf6161d5f 100644 (file)
--- a/src/update_image.c
+++ b/src/update_image.c
@@ -742,9 +742,12 @@ get_capture_config(const tchar *config_file, struct capture_config *config,
 
                size_t len = tstrlen(fs_source_path) +
                             tstrlen(wimboot_cfgfile);
-               tmp_config_file = MALLOC((len + 1) * sizeof(tchar));
                struct stat st;
 
+               tmp_config_file = MALLOC((len + 1) * sizeof(tchar));
+               if (!tmp_config_file)
+                       return WIMLIB_ERR_NOMEM;
+
                tsprintf(tmp_config_file, T("%"TS"%"TS),
                         fs_source_path, wimboot_cfgfile);
                if (!tstat(tmp_config_file, &st)) {
@@ -888,6 +891,7 @@ execute_add_command(struct update_command_journal *j,
 out_destroy_config:
        destroy_capture_config(&config);
 out:
+       FREE(params.cur_path);
        return ret;
 }
 
@@ -1230,7 +1234,7 @@ check_add_command(struct wimlib_update_command *cmd,
        }
 #endif
 
-#ifdef __WIN32__
+#ifdef _WIN32
        /* Check for flags not supported on Windows.  */
        if (add_flags & WIMLIB_ADD_FLAG_UNIX_DATA) {
                ERROR("Capturing UNIX-specific data is not supported on Windows");