Bug 1209551 - Don't read past the end of a buffer in libmar

The index section of a MAR archive file contains several fixed-length fields
and also variable-length names for each file in the archive, terminated by a
null byte. Since that makes the length of the index variable, the length of the
entire index is also provided in the file.
When libmar opens a file, it allocates a buffer with the length given in the
file and reads the index from the file into that buffer.
mar_consume_index() then parses the entire index from that copy,
trying to make sure it doesn't read past the buffer it was given.

The length of the buffer is given to mar_consume_index()
by providing it a pointer to one byte past the end of the buffer.
However, mar_consume_index() treats this pointer as pointing *to* the end.
Therefore, it is possible for a malformed MAR file (one where the stated length
is less than the real length) to trigger a read of one byte beyond the
allocated memory.

Fix this by failing the parse when we reach the buffer end pointer minus one,
instead of when we reach that address itself.

--HG--
extra : amend_source : 3001a5bc08e790251759418e014bbd7153b66d8a

modules/libmar/src/mar_read.c

@@ -91,7 +91,8 @@ static int mar_consume_index(MarFile *mar, char **buf, const char *buf_end) {
   name = *buf;
   /* find namelen; must take care not to read beyond buf_end */
   while (**buf) {
-    if (*buf == buf_end)
+    /* buf_end points one byte past the end of buf's allocation */
+    if (*buf == (buf_end - 1))
       return -1;
     ++(*buf);
   }