From dbdfd71f88796bc7d31f463c68e87adcd569326f Mon Sep 17 00:00:00 2001
From: Giovanni <561184+wargio@users.noreply.github.com>
Date: Mon, 17 Feb 2025 21:14:55 +0800
Subject: [PATCH] Fix CVE-2025-1378 Always ensure skip value is less equal to
 length. (#4912)

* Fix CVE-2025-1378 Always ensure skip value is less equal to length.

* Fixed test
---
 librz/main/rz-asm.c  |  7 ++++++-
 test/db/tools/rz_asm | 12 ++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/librz/main/rz-asm.c b/librz/main/rz-asm.c
index daa2b02ec4..95da890855 100644
--- a/librz/main/rz-asm.c
+++ b/librz/main/rz-asm.c
@@ -901,13 +901,18 @@ RZ_API int rz_main_rz_asm(int argc, const char *argv[]) {
 		if (dis) {
 			char *usrstr = rz_str_dup(opt.argv[opt.ind]);
 			if (!usrstr) {
-				eprintf("rz-asm: disassemble rz_str_dup OOM\n");
+				eprintf("rz-asm: failed to allocate string.\n");
 				ret = 1;
 				goto beach;
 			}
 			len = strlen(usrstr);
 			if (skip && len > skip) {
 				skip *= 2;
+				if (skip > len) {
+					eprintf("rz-asm: invalid skip value (skip %" PFMT64u " > %" PFMT64u " len).\n", skip, len);
+					ret = 1;
+					goto beach;
+				}
 				// eprintf ("SKIP (%s) (%lld)\n", usrstr, skip);
 				memmove(usrstr, usrstr + skip, len - skip);
 				len -= skip;
diff --git a/test/db/tools/rz_asm b/test/db/tools/rz_asm
index e2ed774d5e..2950051ac7 100644
--- a/test/db/tools/rz_asm
+++ b/test/db/tools/rz_asm
@@ -709,3 +709,15 @@ c64x            Texas Instruments TMS320C64x DSP family
 tricore         Generic TriCore CPU family by Infineon
 EOF
 RUN
+
+NAME=rz-asm invalid skip
+FILE=
+CMDS=<<EOF
+!rz-asm -i 6 -E 'mov eax, 30'
+EOF
+EXPECT=<<EOF
+EOF
+EXPECT_ERR=<<EOF
+rz-asm: invalid skip value (skip 12 > 11 len).
+EOF
+RUN