Bug 1184500 - Improve handling of index names in MAR files. r=rstrong, a=2.0+
--- a/modules/libmar/src/mar_read.c
+++ b/modules/libmar/src/mar_read.c
@@ -91,16 +91,20 @@ static int mar_consume_index(MarFile *ma
name = *buf;
/* find namelen; must take care not to read beyond buf_end */
while (**buf) {
if (*buf == buf_end)
return -1;
++(*buf);
}
namelen = (*buf - name);
+ /* must ensure that namelen is valid */
+ if (namelen < 0) {
+ return -1;
+ }
/* consume null byte */
if (*buf == buf_end)
return -1;
++(*buf);
return mar_insert_item(mar, name, namelen, offset, length, flags);
}