portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix CVE-2025-1378 Always ensure skip value is less equal to length. (#4912)

Browse source 
* Fix CVE-2025-1378 Always ensure skip value is less equal to length.

* Fixed test
This commit is contained in:
Giovanni 2025-02-17 21:14:55 +08:00 committed by GitHub
parent aa81fa54bf
commit dbdfd71f88
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
librz/main/rz-asm.c
View file

@ -901,13 +901,18 @@ RZ_API int rz_main_rz_asm(int argc, const char *argv[]) {
if (dis) {
char *usrstr = rz_str_dup(opt.argv[opt.ind]);
if (!usrstr) {
eprintf("rz-asm: disassemble rz_str_dup OOM\n");
eprintf("rz-asm: failed to allocate string.\n");
ret = 1;
goto beach;
}
len = strlen(usrstr);
if (skip && len > skip) {
skip *= 2;
if (skip > len) {
eprintf("rz-asm: invalid skip value (skip %" PFMT64u " > %" PFMT64u " len).\n", skip, len);
ret = 1;
goto beach;
}
// eprintf ("SKIP (%s) (%lld)\n", usrstr, skip);
memmove(usrstr, usrstr + skip, len - skip);
len -= skip;

12
test/db/tools/rz_asm
View file

@ -709,3 +709,15 @@ c64x Texas Instruments TMS320C64x DSP family
tricore Generic TriCore CPU family by Infineon
EOF
RUN
NAME=rz-asm invalid skip
FILE=
CMDS=<<EOF
!rz-asm -i 6 -E 'mov eax, 30'
EOF
EXPECT=<<EOF
EOF
EXPECT_ERR=<<EOF
rz-asm: invalid skip value (skip 12 > 11 len).
EOF
RUN