diff --git a/lib/header.c b/lib/header.c index 2d68854..536aa89 100644 --- a/lib/header.c +++ b/lib/header.c @@ -358,6 +358,9 @@ static int regionSwab(indexEntry entry, int il, int dl, const unsigned char * dataEnd, int regionid) { + if ((entry != NULL && regionid >= 0) || (entry == NULL && regionid != 0)) + return -1; + for (; il > 0; il--, pe++) { struct indexEntry_s ie; rpmTagType type; @@ -822,7 +825,7 @@ Header headerLoad(void * uh) { int off = ntohl(pe->offset); - if (hdrchkData(off)) + if (hdrchkData(off) || hdrchkRange(dl, off)) goto errxit; if (off) { size_t nb = REGION_TAG_COUNT;