commit 9f30de252960dd82ea8283ae27fe5322f6a5b962 Author: Panu Matilainen Date: Thu Jan 19 08:25:15 2012 +0200 Specifically validate region tag on header import - Region tags need to have very specific content, the generic header tag checks are not sufficient to ensure sanity. Verify the tag is one of the known region tags and that the entry has expected type and count. diff --git a/lib/header.c b/lib/header.c index 4ef7564..a64264e 100644 --- a/lib/header.c +++ b/lib/header.c @@ -814,10 +814,13 @@ Header headerLoad(void * uh) entry->info.type = htonl(pe->type); entry->info.count = htonl(pe->count); + entry->info.tag = htonl(pe->tag); - if (hdrchkType(entry->info.type)) + if (!ENTRY_IS_REGION(entry)) + goto errxit; + if (entry->info.type != REGION_TAG_TYPE) goto errxit; - if (hdrchkTags(entry->info.count)) + if (entry->info.count != REGION_TAG_COUNT) goto errxit; { int off = ntohl(pe->offset); @@ -833,7 +836,6 @@ Header headerLoad(void * uh) ril = rdl/sizeof(*pe); if (hdrchkTags(ril) || hdrchkData(rdl)) goto errxit; - entry->info.tag = htonl(pe->tag); } else { ril = il; rdl = (ril * sizeof(struct entryInfo_s));