mirror of
https://github.com/fluffos/fluffos
synced 2026-08-12 18:26:06 -04:00
8b7488d668
f_compress_file()/f_uncompress_file() strcpy()'d the check_valid_path() result (no length bound) into a fixed 1024-byte outname[] stack buffer; an arbitrarily long path overflowed it before any filesystem check ran. Also fixed f_compress_file()'s !real_output_file branch, which called FREE_MSTR(output_file) unconditionally even when output_file was the 2-argument form's stack-owned string, not one we allocated. f_uncompress() accumulated decompressed size into a plain `int len` across the whole inflate() loop with no bound, only rejecting an oversized result via allocate_buffer()'s cap *after* fully expanding it -- letting a small, highly compressible input drive unbounded intermediate allocation/copy work (and, past ~2GB output, overflow `len` itself). Now checks `len` against __MAX_BUFFER_SIZE__ every iteration and bails out immediately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YTPLudxra3u1andNyWJEQG |
||
|---|---|---|
| .. | ||
| zipbomb.zbin | ||