aboutsummaryrefslogtreecommitdiffstats
path: root/main/libmspack/CVE-2019-1010305.patch
blob: af113af2d34cd8d6f186cb19c5cf4ba563ceeea2 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
diff --git a/mspack/chmd.c b/mspack/chmd.c
index 1d198bf..26c1b18 100644
--- a/mspack/chmd.c
+++ b/mspack/chmd.c
@@ -482,21 +482,19 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
       fi->filename[name_len] = '\0';
 
       if (name[0] == ':' && name[1] == ':') {
-	/* system file */
-	if (mspack_memcmp(&name[2], &content_name[2], 31L) == 0) {
-	  if (mspack_memcmp(&name[33], &content_name[33], 8L) == 0) {
-	    chm->sec1.content = fi;
-	  }
-	  else if (mspack_memcmp(&name[33], &control_name[33], 11L) == 0) {
-	    chm->sec1.control = fi;
-	  }
-	  else if (mspack_memcmp(&name[33], &spaninfo_name[33], 8L) == 0) {
-	    chm->sec1.spaninfo = fi;
-	  }
-	  else if (mspack_memcmp(&name[33], &rtable_name[33], 72L) == 0) {
-	    chm->sec1.rtable = fi;
-	  }
-	}
+	    /* system file */
+        if (name_len == 40 && memcmp(name, content_name, 40) == 0) {
+          chm->sec1.content = fi;
+        }
+        else if (name_len == 44 && memcmp(name, control_name, 44) == 0) {
+          chm->sec1.control = fi;
+        }
+        else if (name_len == 41 && memcmp(name, spaninfo_name, 41) == 0) {
+          chm->sec1.spaninfo = fi;
+        }
+        else if (name_len == 105 && memcmp(name, rtable_name, 105) == 0) {
+          chm->sec1.rtable = fi;
+        }
 	fi->next = chm->sysfiles;
 	chm->sysfiles = fi;
       }