Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2025-03-04 20:39:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix r_io_seek and coreBlockShift crash

Browse Source
This commit is contained in:
pancake 2017-08-25 23:45:37 +02:00
parent 3818684096
commit 16dcd8c10e
3 changed files with 33 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libr/core/cio.c
View File

@ -352,18 +352,31 @@ R_API int r_core_shift_block(RCore *core, ut64 addr, ut64 b_size, st64 dist) {
if (b_size == 0 || b_size == (ut64) -1) {
res = r_io_use_fd (core->io, core->file->fd);
file_sz = r_io_size (core->io);
if (file_sz == UT64_MAX) {
file_sz = 0;
}
#if 0
bstart = r_io_seek (core->io, addr, R_IO_SEEK_SET);
fend = r_io_seek (core->io, 0, R_IO_SEEK_END);
if (fend < 1) {
fend = 0;
}
#else
bstart = 0;
fend = file_sz;
#endif
fstart = file_sz - fend;
b_size = fend > bstart ? fend - bstart: 0;
}
// XXX handling basic cases atm
if (b_size < 1) {
return false;
}
shift_buf = malloc (b_size);
memset (shift_buf, 0, b_size);
shift_buf = calloc (b_size, 1);
if (!shift_buf) {
eprintf ("Cannot allocated %d bytes\n", b_size);
return false;
}
// cases
// addr + b_size + dist > file_end
@ -377,17 +390,15 @@ R_API int r_core_shift_block(RCore *core, ut64 addr, ut64 b_size, st64 dist) {
// addr + dist < file_start
if (addr + dist < fstart) {
res = false;
}
// addr + dist > file_end
else if ( (addr) + dist > fend) {
} else if ( (addr) + dist > fend) {
res = false;
} else {
r_io_use_fd (core->io, core->file->fd);
r_io_read_at (core->io, addr, shift_buf, b_size);
r_io_write_at (core->io, addr+dist, shift_buf, b_size);
r_io_write_at (core->io, addr + dist, shift_buf, b_size);
res = true;
}
r_core_seek (core, addr, 1);
free (shift_buf);
return res;

3
libr/io/io.c
View File

@ -634,6 +634,9 @@ R_API ut64 r_io_seek(RIO* io, ut64 offset, int whence) {
io->off = UT64_MAX;
break;
}
if (io && io->desc && io->desc->plugin && io->desc->plugin->lseek) {
return io->off = io->desc->plugin->lseek (io, io->desc, offset, whence);
}
return io->off;
}

21
libr/io/p/io_malloc.c
View File

@ -86,16 +86,17 @@ static bool __resize(RIO *io, RIODesc *fd, ut64 count) {
if (!fd || !fd->data || count == 0) {
return false;
}
if (_io_malloc_off (fd) > _io_malloc_sz (fd)) {
ut32 mallocsz = _io_malloc_sz (fd);
if (_io_malloc_off (fd) > mallocsz) {
return false;
}
new_buf = malloc (count);
if (!new_buf) {
return -1;
}
memcpy (new_buf, _io_malloc_buf (fd), R_MIN (count, _io_malloc_sz (fd)));
if (count > _io_malloc_sz (fd)) {
memset (new_buf + _io_malloc_sz (fd), 0, count - _io_malloc_sz (fd));
memcpy (new_buf, _io_malloc_buf (fd), R_MIN (count, mallocsz));
if (count > mallocsz) {
memset (new_buf + mallocsz, 0, count - mallocsz);
}
free (_io_malloc_buf (fd));
_io_malloc_set_buf (fd, new_buf);
@ -108,11 +109,12 @@ static int __read(RIO *io, RIODesc *fd, ut8 *buf, int count) {
if (!fd || !fd->data) {
return -1;
}
if (_io_malloc_off (fd) > _io_malloc_sz (fd)) {
ut32 mallocsz = _io_malloc_sz (fd);
if (_io_malloc_off (fd) > mallocsz) {
return -1;
}
if (_io_malloc_off (fd) + count >= _io_malloc_sz (fd)) {
count = _io_malloc_sz (fd) - _io_malloc_off (fd);
if (_io_malloc_off (fd) + count >= mallocsz) {
count = mallocsz - _io_malloc_off (fd);
}
memcpy (buf, _io_malloc_buf (fd) + _io_malloc_off (fd), count);
return count;
@ -134,12 +136,13 @@ static ut64 __lseek(RIO* io, RIODesc *fd, ut64 offset, int whence) {
if (!fd || !fd->data) {
return offset;
}
ut32 mallocsz = _io_malloc_sz (fd);
switch (whence) {
case SEEK_SET:
r_offset = (offset <= _io_malloc_sz (fd)) ? offset : _io_malloc_sz (fd);
r_offset = (offset <= mallocsz) ? offset : mallocsz;
break;
case SEEK_CUR:
r_offset = (_io_malloc_off (fd) + offset <= _io_malloc_sz (fd)) ? _io_malloc_off (fd) + offset : _io_malloc_sz (fd);
r_offset = (_io_malloc_off (fd) + offset <= mallocsz ) ? _io_malloc_off (fd) + offset : mallocsz;
break;
case SEEK_END:
r_offset = _io_malloc_sz (fd);