/* Provenance: Firefox libmar mar_insert_item after CVE-2020-15667. * repo: mozilla-central * commit: b79b6cc78248eea7fda10bfb76aa273c19c9fa65 * parent: 0c0f777161a9499dd149853ff62d356f75d16c2a * commit_url: https://hg.mozilla.org/mozilla-central/rev/b79b6cc78248eea7fda10bfb76aa273c19c9fa65 * phabricator: https://phabricator.services.mozilla.com/rMOZILLACENTRALb79b6cc78248eea7fda10bfb76aa273c19c9fa65 * cve: CVE-2020-15667 * bug: 1653371 * license: MPL-2.0 * function: mar_insert_item * relpath: modules/libmar/src/mar_read.c */ #include #include #include typedef struct MarItem_ { struct MarItem_ *next; uint32_t offset; uint32_t length; uint32_t flags; char name[1]; } MarItem; typedef struct { MarItem *item_table[256]; } MarFile; static uint32_t mar_hash_name(const char *name) { (void)name; return 0; } static int mar_insert_item(MarFile *mar, const char *name, uint32_t namelen, uint32_t offset, uint32_t length, uint32_t flags) { MarItem *item, *root; uint32_t hash; item = (MarItem *)malloc(sizeof(MarItem) + namelen); if (!item) { return -1; } item->next = NULL; item->offset = offset; item->length = length; item->flags = flags; memcpy(item->name, name, namelen + 1); hash = mar_hash_name(name); root = mar->item_table[hash]; if (!root) { mar->item_table[hash] = item; } else { /* append item */ while (root->next) root = root->next; root->next = item; } return 0; }