[Rpm-maint] [rpm-software-management/rpm] Check that ‘einfo.offset’ is reasonable (#1494)

[Demi Marie Obenour]

This overflow does not result in any form of memory unsafety or undefined behavior.  `REGION_TAG_OFFSET` is of type `size_t`, so `einfo.offset` gets promoted to `size_t`.  That, in turn, causes the addition to wrap around.  The only problematic cases are where `einfo.offset` is negative, but not below `-REGION_TAG_OFFSET`.  In this case, the offset check passes, so a negative number gets added to `blob->dataStart`.  Since `einfo.offset` cannot be below `-REGION_TAG_OFFSET`, this means that the trailer winds up being read from the header index, which is rather silly, but harmless.  Nevertheless, this is still invalid and should be rejected.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1494#issuecomment-780273018
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20210216/cb4136fa/attachment.html>