Fix checks for huge numbers of images

diff --git a/include/wimlib/header.h b/include/wimlib/header.h
index 62d916f0656375e6d9b7bc46f1faead8e8ebb433..290e0b2cda2ed28544f0225c6c015ebee10110b1 100644 (file)
--- a/include/wimlib/header.h
+++ b/include/wimlib/header.h
@@ -5,6 +5,8 @@
 #include "wimlib/types.h"
 #include "wimlib/endianness.h"
 
 #include "wimlib/types.h"
 #include "wimlib/endianness.h"
 

+#include <limits.h>
+

 /* Length of "Globally Unique ID" field in WIM header.  */
 #define WIM_GUID_LEN    16
 
 /* Length of "Globally Unique ID" field in WIM header.  */
 #define WIM_GUID_LEN    16
 


@@ -115,6 +117,7 @@ struct wim_header_disk {
        /* +0xd0 (208)  */
 } _packed_attribute;
 
        /* +0xd0 (208)  */
 } _packed_attribute;
 

+#define MAX_IMAGES (((INT_MAX < INT32_MAX) ? INT_MAX : INT32_MAX) - 1)

 
 /* In-memory representation of a WIM header.  See `struct wim_header_disk' for
  * field descriptions.  */
 
 /* In-memory representation of a WIM header.  See `struct wim_header_disk' for
  * field descriptions.  */

diff --git a/src/header.c b/src/header.c
index 30b2b13204abc8dd6fd0a1bd3df6511711876584..57cea04f1ae96442be014cfa8f9559924be01ecc 100644 (file)
--- a/src/header.c
+++ b/src/header.c
@@ -141,7 +141,7 @@ read_wim_header(WIMStruct *wim, struct wim_header *hdr)
        DEBUG("part_number = %u, total_parts = %u, image_count = %u",
              hdr->part_number, hdr->total_parts, hdr->image_count);
 
        DEBUG("part_number = %u, total_parts = %u, image_count = %u",
              hdr->part_number, hdr->total_parts, hdr->image_count);
 

-       if (hdr->image_count >= INT_MAX) {
+       if (unlikely(hdr->image_count > MAX_IMAGES)) {

                ERROR("\"%"TS"\": Invalid image count (%u)",
                      filename, hdr->image_count);
                return WIMLIB_ERR_IMAGE_COUNT;
                ERROR("\"%"TS"\": Invalid image count (%u)",
                      filename, hdr->image_count);
                return WIMLIB_ERR_IMAGE_COUNT;

diff --git a/src/xml.c b/src/xml.c
index 7ff9c615cda47af72b6366d18ce2e10fe5e39dbb..6233462c9ca53bc590549e8c8d3d093d1a49b436 100644 (file)
--- a/src/xml.c
+++ b/src/xml.c
@@ -572,8 +572,9 @@ xml_read_wim_info(const xmlNode *wim_node, struct wim_info **wim_info_ret)
        num_images = 0;
        for_node_child(wim_node, child) {
                if (node_is_element(child) && node_name_is(child, "IMAGE")) {
        num_images = 0;
        for_node_child(wim_node, child) {
                if (node_is_element(child) && node_name_is(child, "IMAGE")) {

-                       if (num_images == INT_MAX) {
-                               return WIMLIB_ERR_IMAGE_COUNT;
+                       if (unlikely(num_images == MAX_IMAGES)) {
+                               ret = WIMLIB_ERR_IMAGE_COUNT;
+                               goto err;

                        }
                        num_images++;
                }
                        }
                        num_images++;
                }


@@ -623,7 +624,8 @@ xml_read_wim_info(const xmlNode *wim_node, struct wim_info **wim_info_ret)
                                ERROR("WIM images are not indexed [1...%d] "
                                      "in XML data as expected",
                                      num_images);
                                ERROR("WIM images are not indexed [1...%d] "
                                      "in XML data as expected",
                                      num_images);

-                               return WIMLIB_ERR_IMAGE_COUNT;
+                               ret = WIMLIB_ERR_IMAGE_COUNT;
+                               goto err;

                        }
                }
 
                        }
                }