zchunk: fix bounds check in getuint

mlschroe · mlschroe · commit d6657a285dce · 2018-07-20T14:04:58.000+02:00
diff --git a/ext/solv_zchunk.c b/ext/solv_zchunk.c
@@ -58,27 +58,27 @@ getuint(unsigned char *p, unsigned char *endp, unsigned int *dp)
 {
   if (!p || p >= endp)
     return 0;
-  if (p <= endp && (*p & 0x80) != 0)
+  if (p < endp && (*p & 0x80) != 0)
     {
       *dp = p[0] ^ 0x80;
       return p + 1;
     }
-  if (++p <= endp && (*p & 0x80) != 0)
+  if (++p < endp && (*p & 0x80) != 0)
     {
       *dp = p[-1] ^ ((p[0] ^ 0x80) << 7);
       return p + 1;
     }
-  if (++p <= endp && (*p & 0x80) != 0)
+  if (++p < endp && (*p & 0x80) != 0)
     {
       *dp = p[-2] ^ (p[-1] << 7) ^ ((p[0] ^ 0x80) << 14);
       return p + 1;
     }
-  if (++p <= endp && (*p & 0x80) != 0)
+  if (++p < endp && (*p & 0x80) != 0)
     {
       *dp = p[-3] ^ (p[-2] << 7) ^ (p[1] << 14) ^ ((p[0] ^ 0x80) << 21);
       return p + 1;
     }
-  if (++p <= endp && (*p & 0xf0) == 0x80)
+  if (++p < endp && (*p & 0xf0) == 0x80)
     {
       *dp = p[-4] ^ (p[-3] << 7) ^ (p[2] << 14) ^ (p[1] << 21) ^ ((p[0] ^ 0x80) << 28);
       return p + 1;

Original file line number	Diff line number	Diff line change
`@@ -58,27 +58,27 @@ getuint(unsigned char p, unsigned char endp, unsigned int *dp)`
`58`	`58`	`{`
`59`	`59`	`if (!p \|\| p >= endp)`
`60`	`60`	`return 0;`
`61`		`- if (p <= endp && (*p & 0x80) != 0)`
	`61`	`+ if (p < endp && (*p & 0x80) != 0)`
`62`	`62`	`{`
`63`	`63`	`*dp = p[0] ^ 0x80;`
`64`	`64`	`return p + 1;`
`65`	`65`	`}`
`66`		`- if (++p <= endp && (*p & 0x80) != 0)`
	`66`	`+ if (++p < endp && (*p & 0x80) != 0)`
`67`	`67`	`{`
`68`	`68`	`*dp = p[-1] ^ ((p[0] ^ 0x80) << 7);`
`69`	`69`	`return p + 1;`
`70`	`70`	`}`
`71`		`- if (++p <= endp && (*p & 0x80) != 0)`
	`71`	`+ if (++p < endp && (*p & 0x80) != 0)`
`72`	`72`	`{`
`73`	`73`	`*dp = p[-2] ^ (p[-1] << 7) ^ ((p[0] ^ 0x80) << 14);`
`74`	`74`	`return p + 1;`
`75`	`75`	`}`
`76`		`- if (++p <= endp && (*p & 0x80) != 0)`
	`76`	`+ if (++p < endp && (*p & 0x80) != 0)`
`77`	`77`	`{`
`78`	`78`	`*dp = p[-3] ^ (p[-2] << 7) ^ (p[1] << 14) ^ ((p[0] ^ 0x80) << 21);`
`79`	`79`	`return p + 1;`
`80`	`80`	`}`
`81`		`- if (++p <= endp && (*p & 0xf0) == 0x80)`
	`81`	`+ if (++p < endp && (*p & 0xf0) == 0x80)`
`82`	`82`	`{`
`83`	`83`	`*dp = p[-4] ^ (p[-3] << 7) ^ (p[2] << 14) ^ (p[1] << 21) ^ ((p[0] ^ 0x80) << 28);`
`84`	`84`	`return p + 1;`