Use safe decompression for MiniLZO to avoid possible stack corruption.

gibbed · May 27, 2019 · 53c53bf · 53c53bf
1 parent 05bfa5d
commit 53c53bf
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 13 deletions.
diff --git a/projects/Gibbed.BorderlandsOz.FileFormats/SaveFile.cs b/projects/Gibbed.BorderlandsOz.FileFormats/SaveFile.cs
@@ -360,12 +360,13 @@ public static SaveFile Deserialize(Stream input, Platform platform, DeserializeS
                         var actualUncompressedSize = (int)uncompressedSize;
                         var compressedSize = (int)(data.Length - 4);
                         var compressedBytes = data.ReadBytes(compressedSize);
-                        var result = MiniLZO.LZO.Decompress(compressedBytes,
-                                                            0,
-                                                            (int)compressedSize,
-                                                            uncompressedBytes,
-                                                            0,
-                                                            ref actualUncompressedSize);
+                        var result = MiniLZO.LZO.DecompressSafe(
+                            compressedBytes,
+                            0,
+                            (int)compressedSize,
+                            uncompressedBytes,
+                            0,
+                            ref actualUncompressedSize);
                         if (result != MiniLZO.ErrorCode.Success)
                         {
                             throw new SaveCorruptionException(string.Format("LZO decompression failure ({0})", result));
@@ -425,12 +426,13 @@ public static SaveFile Deserialize(Stream input, Platform platform, DeserializeS
                             var actualUncompressedSize = blockUncompressedSize;
                             var compressedSize = (int)blockInfo.Item1;
                             var compressedBytes = data.ReadBytes(compressedSize);
-                            var result = MiniLZO.LZO.Decompress(compressedBytes,
-                                                                0,
-                                                                compressedSize,
-                                                                uncompressedBytes,
-                                                                uncompressedOffset,
-                                                                ref actualUncompressedSize);
+                            var result = MiniLZO.LZO.DecompressSafe(
+                                compressedBytes,
+                                0,
+                                compressedSize,
+                                uncompressedBytes,
+                                uncompressedOffset,
+                                ref actualUncompressedSize);
                             if (result != MiniLZO.ErrorCode.Success)
                             {
                                 throw new SaveCorruptionException(string.Format("LZO decompression failure ({0})",

diff --git a/projects/VerifySaves/Program.cs b/projects/VerifySaves/Program.cs
@@ -68,7 +68,7 @@ private static void Main(string[] args)
                         var uncompressedBytes = new byte[uncompressedSize];
                         var compressedSize = (int)(data.Length - 4);
                         var compressedBytes = data.ReadBytes(compressedSize);
-                        var result = MiniLZO.LZO.Decompress(
+                        var result = MiniLZO.LZO.DecompressSafe(
                             compressedBytes,
                             0,
                             compressedSize,