From b9515bb51e5d23effe6b1ee86f4c50f600261df8 Mon Sep 17 00:00:00 2001 From: Rot127 Date: Wed, 23 Sep 2026 20:45:36 +0200 Subject: [PATCH] Partially port bound checks from radare2/6727454b666b28c33837b219a5f91136461357c0 Co-authored-by: pancake --- librz/bin/format/pyc/marshal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/librz/bin/format/pyc/marshal.c b/librz/bin/format/pyc/marshal.c index 1ce4b69eb1..20246d40d0 100644 --- a/librz/bin/format/pyc/marshal.c +++ b/librz/bin/format/pyc/marshal.c @@ -69,6 +69,8 @@ static double get_float64(RzBuffer *buffer, bool *error) { } static ut8 *get_bytes(RzBuffer *buffer, ut32 size) { + rz_return_val_if_fail(size < ST32_MAX && buffer, NULL); + ut8 *ret = RZ_NEWS0(ut8, size + 1); if (!ret) { return NULL; @@ -208,14 +210,14 @@ static pyc_object *get_long_object(RzBuffer *buffer) { tmp |= n << left; left += 15; - while (left >= 4) { + while (left >= 4 && j > 0) { hexstr[--j] = digist2hex[tmp & 0xf]; tmp >>= 4; left -= 4; } } - if (tmp) { + if (tmp && j > 0) { hexstr[--j] = digist2hex[tmp & 0xf]; }