commit 581db7f8215387cd722b9f06a5afbd4df9617072
author Nikias Bassen <nikias@gmx.li> Fri Apr 21 12:10:20 2023 +0200
committer Nikias Bassen <nikias@gmx.li> Fri Apr 21 12:10:20 2023 +0200
tree d5b8515a69cca924d87e150ac2b0af97bc3781d8
parent 3fdb11126928717007127688f55a5fffa8a59ac9

bplist: Fix offset range check

Credit to OSS-Fuzz

src/bplist.c

diff --git a/src/bplist.c b/src/bplist.c
index d29d499..e9b71eb 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -748,7 +748,7 @@
 
     ptr = bplist->data + UINT_TO_HOST(idx_ptr, bplist->offset_size);
     /* make sure the node offset is in a sane range */
-    if ((ptr < bplist->data) || (ptr >= bplist->offset_table)) {
+    if ((ptr < bplist->data+BPLIST_MAGIC_SIZE+BPLIST_VERSION_SIZE) || (ptr >= bplist->offset_table)) {
         PLIST_BIN_ERR("offset for node index %u points outside of valid range\n", node_index);
         return NULL;
     }