Fix oobread segfault in java arith8.class ##crash

* Reported by Cen Zhang via huntr.dev
radareorg · Feb 7, 2022 · 9650e3c · 9650e3c
1 parent 79b39bb
commit 9650e3c
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/shlr/java/class.c b/shlr/java/class.c
@@ -3733,6 +3733,10 @@ R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8
 	ut64 offset = 0, curpos;
 	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
 	offset += 6;
+	if (buf_offset + offset + 8 > sz) {
+		eprintf ("Invalid amount of inner classes\n");
+		return NULL;
+	}
 	if (attr == NULL) {
 		// TODO eprintf
 		return attr;
@@ -3743,7 +3747,7 @@ R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8
 	attr->info.inner_classes_attr.classes = r_list_newf (r_bin_java_inner_classes_attr_entry_free);
 	for (i = 0; i < attr->info.inner_classes_attr.number_of_classes; i++) {
 		curpos = buf_offset + offset;
-		if (offset + 8 > sz) {
+		if (buf_offset + offset + 8 > sz) {
 			eprintf ("Invalid amount of inner classes\n");
 			break;
 		}