Pull request #4807: "Fixed Snort 3 VBA decompression divide-by-zero crasher"

Merge in SNORT/snort3 from ~SRAMDENI/snort3:master to master

Squashed commit of the following:

commit 404452dc857887b4a86c98156f18817ef5d6c5a8
Author: sramdeni <sramdeni@cisco.com>
Date:   Mon Jul 14 15:37:42 2025 +0530

    fileole_vba : Fixed snort 3 vba decompression divide-by-zero crasher

diff --git a/src/decompress/file_olefile.cc b/src/decompress/file_olefile.cc
index c6971fd9c745eacb7b345335b02e0fdede24d00f..45303ccf17192a0470e591a9cf610a849c14de76 100644 (file)
--- a/src/decompress/file_olefile.cc
+++ b/src/decompress/file_olefile.cc
@@ -231,6 +231,8 @@ int32_t OleFile :: get_mini_fat_offset(int32_t sec_id)
     int32_t sec_position, mini_sec_position, count, current_sector;
     int32_t byte_offset, mini_fat_persector;
 
+    if (header->get_mini_sector_size() <= 0)
+        return -1;
     mini_fat_persector = header->get_sector_size() / header->get_mini_sector_size();
 
     if (sec_id >=  mini_fat_persector)
@@ -345,7 +347,7 @@ void OleFile :: get_file_data(FileProperty* node, uint8_t*& file_data, uint32_t&
                 }
                 visited_mini_sectors.insert(mini_sector);
                 byte_offset = get_mini_fat_offset(mini_sector);
-                if (byte_offset > buf_len)
+                if (byte_offset == -1 || byte_offset > buf_len)
                     return;
 
                 bytes_to_copy = find_bytes_to_copy(byte_offset, data_len,