diff --git a/src/dwarfs/filesystem_v2.cpp b/src/dwarfs/filesystem_v2.cpp index 1af18cb6..4f4edb9a 100644 --- a/src/dwarfs/filesystem_v2.cpp +++ b/src/dwarfs/filesystem_v2.cpp @@ -98,11 +98,18 @@ class filesystem_parser { auto sh = mm.as(pos); if (sh->number == 0) { - if (pos + 2 * sizeof(section_header_v2) + sh->length >= mm.size()) { + auto endpos = pos + sh->length + 2 * sizeof(section_header_v2); + + if (endpos < sh->length) { + // overflow break; } - ps = mm.as(pos + sizeof(section_header_v2) + sh->length); + if (endpos >= mm.size()) { + break; + } + + ps = mm.as(pos + sh->length + sizeof(section_header_v2)); if (::memcmp(ps, magic.data(), magic.size()) == 0 and reinterpret_cast(ps)->number == 1) {