diff --git a/tsk/fs/ntfs.c b/tsk/fs/ntfs.c index 1761856acb6dd37498da081a945f67e0ecfd7583..ead397aa466357ccf570c442abce6b3af2109487 100755 --- a/tsk/fs/ntfs.c +++ b/tsk/fs/ntfs.c @@ -851,7 +851,15 @@ static int ntfs_uncompress_setup(TSK_FS_INFO * fs, NTFS_COMP_INFO * comp, uint32_t compunit_size_c) { + if (fs->block_size == 0 || compunit_size_c == 0) { + return 1; + } comp->buf_size_b = fs->block_size * compunit_size_c; + + // Detect an integer overflow e.g. 65536 * 65536 + if (comp->buf_size_b < fs->block_size) { + return 1; + } if ((comp->uncomp_buf = tsk_malloc(comp->buf_size_b)) == NULL) { comp->buf_size_b = 0; return 1; @@ -1214,6 +1222,11 @@ ntfs_proc_compunit(NTFS_INFO * ntfs, NTFS_COMP_INFO * comp, for (a = 0; a < comp_unit_size; a++) { ssize_t cnt; + // Prevent an OOB write of comp->uncomp_buf + if ((comp->uncomp_idx >= comp->buf_size_b) || (fs->block_size > comp->buf_size_b - comp->uncomp_idx)) { + return 1; + } + cnt = tsk_fs_read_block(fs, comp_unit[a], &comp->uncomp_buf[comp->uncomp_idx], fs->block_size);