diff -Nur p7zip/CPP/7zip/Compress/Rar1Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.cpp --- p7zip/CPP/7zip/Compress/Rar1Decoder.cpp 2015-09-02 02:04:52.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.cpp 2019-03-06 22:04:37.659374132 +0800 @@ -29,7 +29,7 @@ }; */ -CDecoder::CDecoder(): m_IsSolid(false) { } +CDecoder::CDecoder(): m_IsSolid(false), _errorMode(false) { } void CDecoder::InitStructures() { @@ -406,9 +406,14 @@ InitData(); if (!m_IsSolid) { + _errorMode = false; InitStructures(); InitHuff(); } + + if (_errorMode) + return S_FALSE; + if (m_UnpackSize > 0) { GetFlagsBuf(); @@ -477,9 +482,9 @@ const UInt64 *inSize, const UInt64 *outSize, ICompressProgressInfo *progress) { try { return CodeReal(inStream, outStream, inSize, outSize, progress); } - catch(const CInBufferException &e) { return e.ErrorCode; } - catch(const CLzOutWindowException &e) { return e.ErrorCode; } - catch(...) { return S_FALSE; } + catch(const CInBufferException &e) { _errorMode = true; return e.ErrorCode; } + catch(const CLzOutWindowException &e) { _errorMode = true; return e.ErrorCode; } + catch(...) { _errorMode = true; return S_FALSE; } } STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size) diff -Nur p7zip/CPP/7zip/Compress/Rar1Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.h --- p7zip/CPP/7zip/Compress/Rar1Decoder.h 2014-12-21 20:44:00.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar1Decoder.h 2019-03-06 22:04:37.659374132 +0800 @@ -39,6 +39,7 @@ Int64 m_UnpackSize; bool m_IsSolid; + bool _errorMode; UInt32 ReadBits(int numBits); HRESULT CopyBlock(UInt32 distance, UInt32 len); diff -Nur p7zip/CPP/7zip/Compress/Rar2Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.cpp --- p7zip/CPP/7zip/Compress/Rar2Decoder.cpp 2015-10-03 16:49:14.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.cpp 2019-03-06 22:04:37.659374132 +0800 @@ -80,7 +80,8 @@ static const UInt32 kWindowReservSize = (1 << 22) + 256; CDecoder::CDecoder(): - m_IsSolid(false) + m_IsSolid(false), + m_TablesOK(false) { } @@ -100,6 +101,8 @@ bool CDecoder::ReadTables(void) { + m_TablesOK = false; + Byte levelLevels[kLevelTableSize]; Byte newLevels[kMaxTableSize]; m_AudioMode = (ReadBits(1) == 1); @@ -170,6 +173,8 @@ } memcpy(m_LastLevels, newLevels, kMaxTableSize); + m_TablesOK = true; + return true; } @@ -344,6 +349,9 @@ return S_FALSE; } + if (!m_TablesOK) + return S_FALSE; + UInt64 startPos = m_OutWindowStream.GetProcessedSize(); while (pos < unPackSize) { diff -Nur p7zip/CPP/7zip/Compress/Rar2Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.h --- p7zip/CPP/7zip/Compress/Rar2Decoder.h 2015-06-19 18:52:06.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar2Decoder.h 2019-03-06 22:04:37.659374132 +0800 @@ -139,6 +139,7 @@ UInt64 m_PackSize; bool m_IsSolid; + bool m_TablesOK; void InitStructures(); UInt32 ReadBits(unsigned numBits); diff -Nur p7zip/CPP/7zip/Compress/Rar3Decoder.cpp CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.cpp --- p7zip/CPP/7zip/Compress/Rar3Decoder.cpp 2016-05-20 16:20:03.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.cpp 2019-03-06 22:04:37.659374132 +0800 @@ -92,7 +92,8 @@ _writtenFileSize(0), _vmData(0), _vmCode(0), - m_IsSolid(false) + m_IsSolid(false), + _errorMode(false) { Ppmd7_Construct(&_ppmd); } @@ -545,6 +546,9 @@ return InitPPM(); } + TablesRead = false; + TablesOK = false; + _lzMode = true; PrevAlignBits = 0; PrevAlignCount = 0; @@ -606,6 +610,9 @@ } } } + if (InputEofError()) + return S_FALSE; + TablesRead = true; // original code has check here: @@ -623,6 +630,9 @@ RIF(m_LenDecoder.Build(&newLevels[kMainTableSize + kDistTableSize + kAlignTableSize])); memcpy(m_LastLevels, newLevels, kTablesSizesSum); + + TablesOK = true; + return S_OK; } @@ -824,7 +834,12 @@ PpmEscChar = 2; PpmError = true; InitFilters(); + _errorMode = false; } + + if (_errorMode) + return S_FALSE; + if (!m_IsSolid || !TablesRead) { bool keepDecompressing; @@ -838,6 +853,8 @@ bool keepDecompressing; if (_lzMode) { + if (!TablesOK) + return S_FALSE; RINOK(DecodeLZ(keepDecompressing)) } else @@ -901,8 +918,8 @@ _unpackSize = outSize ? *outSize : (UInt64)(Int64)-1; return CodeReal(progress); } - catch(const CInBufferException &e) { return e.ErrorCode; } - catch(...) { return S_FALSE; } + catch(const CInBufferException &e) { _errorMode = true; return e.ErrorCode; } + catch(...) { _errorMode = true; return S_FALSE; } // CNewException is possible here. But probably CNewException is caused // by error in data stream. } diff -Nur p7zip/CPP/7zip/Compress/Rar3Decoder.h CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.h --- p7zip/CPP/7zip/Compress/Rar3Decoder.h 2015-10-03 16:49:12.000000000 +0800 +++ CVE-2018-5996_mod/CPP/7zip/Compress/Rar3Decoder.h 2019-03-06 22:04:37.659374132 +0800 @@ -192,6 +192,7 @@ UInt32 _lastFilter; bool m_IsSolid; + bool _errorMode; bool _lzMode; bool _unsupportedFilter; @@ -200,6 +201,7 @@ UInt32 PrevAlignCount; bool TablesRead; + bool TablesOK; CPpmd7 _ppmd; int PpmEscChar;