forkless/NotAlterra
1
0
Fork 0
mirror of https://github.com/forkless/NotAlterra.git synced 2026-08-21 10:28:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

add full_metadata fuzz target, fix OOB crash in property extractors

Browse Source
This commit is contained in:
forkless
2026-06-02 17:17:50 +02:00
parent 277d4796e1
commit a2020a2e2c
4 changed files with 54 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gvas.rs
+4 -4
View File
@@ -140,7 +140,7 @@ fn extract_str_property(data: &[u8], prop_name: &str) -> Result<String, String>
attempts += 1;
continue;
}
if data[found + target.len()] != 0 {
if found + target.len() >= data.len() || data[found + target.len()] != 0 {
offset = found + 1;
attempts += 1;
continue;
@@ -187,7 +187,7 @@ fn extract_bool_property(data: &[u8], prop_name: &str) -> Option<bool> {
if found < 4 { offset = found + 1; attempts += 1; continue; }
let name_len_field = read_u32(data, found - 4);
if name_len_field != Some(target.len() + 1) { offset = found + 1; attempts += 1; continue; }
if data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
if found + target.len() >= data.len() || data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
let after_name = found + target.len() + 1;
let (next_name, next_offset) = read_fname(data, after_name);
if next_name.as_deref() != Some("BoolProperty") { offset = found + 1; attempts += 1; continue; }
@@ -223,7 +223,7 @@ fn extract_double_property(data: &[u8], prop_name: &str) -> Option<f64> {
if found < 4 { offset = found + 1; attempts += 1; continue; }
let expected: usize = target.len() + 1;
if read_u32(data, found - 4) != Some(expected) { offset = found + 1; attempts += 1; continue; }
if data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
if found + target.len() >= data.len() || data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
let (next_name, next_offset) = read_fname(data, found + target.len() + 1);
if next_name.as_deref() != Some("DoubleProperty") { offset = found + 1; attempts += 1; continue; }
let val_offset = next_offset + 9;
@@ -243,7 +243,7 @@ fn extract_int_property(data: &[u8], prop_name: &str) -> Option<u32> {
let found = match found { Some(p) => offset + p, None => return None };
if found < 4 { offset = found + 1; attempts += 1; continue; }
if read_u32(data, found - 4) != Some(target.len() + 1) { offset = found + 1; attempts += 1; continue; }
if data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
if found + target.len() >= data.len() || data[found + target.len()] != 0 { offset = found + 1; attempts += 1; continue; }
let (next_name, next_offset) = read_fname(data, found + target.len() + 1);
if next_name.as_deref() != Some("IntProperty") { offset = found + 1; attempts += 1; continue; }
let val_offset = next_offset + 9;