From 5a6b36a630658c99da1bd8e8167ae258ac94f8b3 Mon Sep 17 00:00:00 2001 From: "Saikrishna Ramdeni (sramdeni)" Date: Fri, 25 Jul 2025 09:59:11 +0000 Subject: [PATCH] Pull request #4807: "Fixed Snort 3 VBA decompression divide-by-zero crasher" Merge in SNORT/snort3 from ~SRAMDENI/snort3:master to master Squashed commit of the following: commit 404452dc857887b4a86c98156f18817ef5d6c5a8 Author: sramdeni Date: Mon Jul 14 15:37:42 2025 +0530 fileole_vba : Fixed snort 3 vba decompression divide-by-zero crasher --- src/decompress/file_olefile.cc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/decompress/file_olefile.cc b/src/decompress/file_olefile.cc index c6971fd9c..45303ccf1 100644 --- a/src/decompress/file_olefile.cc +++ b/src/decompress/file_olefile.cc @@ -231,6 +231,8 @@ int32_t OleFile :: get_mini_fat_offset(int32_t sec_id) int32_t sec_position, mini_sec_position, count, current_sector; int32_t byte_offset, mini_fat_persector; + if (header->get_mini_sector_size() <= 0) + return -1; mini_fat_persector = header->get_sector_size() / header->get_mini_sector_size(); if (sec_id >= mini_fat_persector) @@ -345,7 +347,7 @@ void OleFile :: get_file_data(FileProperty* node, uint8_t*& file_data, uint32_t& } visited_mini_sectors.insert(mini_sector); byte_offset = get_mini_fat_offset(mini_sector); - if (byte_offset > buf_len) + if (byte_offset == -1 || byte_offset > buf_len) return; bytes_to_copy = find_bytes_to_copy(byte_offset, data_len, -- 2.47.3