bb11601 - revise buffer limit check due.

iOSDevSK · Dec 14, 2016 · 7cdd2b5 · 7cdd2b5
1 parent 9ca3fc2
commit 7cdd2b5
Showing 1 changed file with 11 additions and 8 deletions.
diff --git a/libclamunrar/unrarvm.c b/libclamunrar/unrarvm.c
@@ -213,17 +213,20 @@ void rarvm_addbits(rarvm_input_t *rarvm_input, int bits)
 
 unsigned int rarvm_getbits(rarvm_input_t *rarvm_input)
 {
-	unsigned int bit_field;
+	unsigned int bit_field = 0;
 
-	if (rarvm_input->in_addr+2 < rarvm_input->buf_size) {
+	if (rarvm_input->in_addr < rarvm_input->buf_size) {
             bit_field = (unsigned int) rarvm_input->in_buf[rarvm_input->in_addr] << 16;
-            bit_field |= (unsigned int) rarvm_input->in_buf[rarvm_input->in_addr+1] << 8;
-            bit_field |= (unsigned int) rarvm_input->in_buf[rarvm_input->in_addr+2];
-            bit_field >>= (8-rarvm_input->in_bit);
-
-            return (bit_field & 0xffff);
+            if (rarvm_input->in_addr+1 < rarvm_input->buf_size) {
+                bit_field |= (unsigned int) rarvm_input->in_buf[rarvm_input->in_addr+1] << 8;
+                if (rarvm_input->in_addr+2 < rarvm_input->buf_size) {
+                    bit_field |= (unsigned int) rarvm_input->in_buf[rarvm_input->in_addr+2];
+                }
+            }
         }
-        return 0;
+        bit_field >>= (8-rarvm_input->in_bit);
+
+        return (bit_field & 0xffff);
 }
 
 unsigned int rarvm_read_data(rarvm_input_t *rarvm_input)