OVERRUN_STATIC in /inkbugs/inkscape/src/dom/util/ziptool.cpp

[Vaughn Spurlin]

OVERRUN_STATIC in /inkbugs/inkscape/src/dom/util/ziptool.cpp (lines 225-2224)

In Deflater::encodeDistStatic(...):
Out-of-bounds read from an array (CWE-125).

 1180 DistBase distBases[] =
 1181 {
 1182 { 1, 1, 0 },
...
 1211 { 24577, 8192, 13 }
 1212 };
...
 1226 for (int i=0 ; i<30 ; i++)
 1227 {
Overrunning static array "lenBases", with 29 elements, at position 29 with index variable "i".
 1228 unsigned int base = lenBases[i].base;

[Vaughn Spurlin (vspurlin)]

fix suggestion 2010-07-25:
 1212.1 const int distBasesLen = sizeof(distBases) / sizeof(DistBase);
...
 1226 for (int i=0 ; i<distBasesLen ; i++)

fix reason:
  Avoid hardcoded number by defining a constant that the compiler can calculate.

[Jon A. Cruz (jon-joncruz)]

A better fix is probably to convert lenBases to std::vector<lenBase> and distBases to std::vector<distBase>

Other static arrays in the file can similarly be converted.

[Qantas94Heavy (qantas94heavy)]

Fixed in master here: https://gitlab.com/inkscape/inkscape/commit/42ca25f597bc6158477002071f38f85834fa4f79

I will backport this fix to 0.92.x shortly.

[Qantas94Heavy (qantas94heavy)]

Fix committed to 0.92.x here: https://gitlab.com/inkscape/inkscape/commit/2247b618b6d0c3732eefdb6dd81a2d531b44f481