Added sanity checks to tsk_fs_load_file_action #2807

tsk/fs/fs_load.c

@@ -14,6 +14,8 @@
  */
 #include "tsk_fs_i.h"
 
+#include <string.h>
+
 
 /* File Walk Action to load the journal 
  * TSK_FS_LOAD_FILE is defined in fs_tools.h
@@ -25,14 +27,19 @@ tsk_fs_load_file_action(TSK_FS_FILE * fs_file, TSK_OFF_T a_off,
     void *ptr)
 {
     TSK_FS_LOAD_FILE *buf1 = (TSK_FS_LOAD_FILE *) ptr;
-    size_t cp_size;
 
-    if (size > buf1->left)
-        cp_size = buf1->left;
-    else
-        cp_size = size;
+    if (buf1->cur == NULL) {
+        return TSK_WALK_ERROR;
+    }
+    size_t cp_size = size;
+    if (cp_size > buf1->left) cp_size = buf1->left;
 
+    size_t cp_offset = (size_t) (buf1->cur - buf1->base);
+    if (cp_size > buf1->total) || (cp_offset > (buf1->total - cp_size)) {
+        return TSK_WALK_ERROR;
+    }
     memcpy(buf1->cur, buf, cp_size);
+
     buf1->left -= cp_size;
     buf1->cur = (char *) ((uintptr_t) buf1->cur + cp_size);