fix oob write bug inside libmobi

bfabiszewski · Sep 9, 2021 · ab5bf0e · ab5bf0e
1 parent 983b898
commit ab5bf0e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/buffer.c b/src/buffer.c
@@ -510,8 +510,8 @@ void mobi_buffer_move(MOBIBuffer *buf, const int offset, const size_t len) {
         }
         source += aoffset;
     } else {
-        if (buf->offset < aoffset) {
-            debug_print("%s", "End of buffer\n");
+        if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {
+            debug_print("%s", "Beyond start/end of buffer\n");
             buf->error = MOBI_BUFFER_END;
             return;
         }