CVE-2022-1533: Out-of-bounds Read (CWE-125)
value: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-29T11:15Z
Repository: https://github.com/bfabiszewski/libmobi
Language: Other
Files changed: ChangeLog, src/index.c
Commit date: 2022-04-27 12:33:05 +0200
Commit message: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input

Diff: diff --git a/ChangeLog b/ChangeLog
index 8171034..b431347 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
+2022-04-27: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input
 2022-04-26: Fix text formatting
 2022-04-26: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input
 2022-04-23: Fix formatting
 2022-04-23: Fix checking boundary of deobfuscation key which could cause buffer over-read with corrupt data
 2022-04-23: Fix issue with corrupt data with empty lookup string which could lead to read beyond buffer
diff --git a/src/index.c b/src/index.c
index 7e4f3b7..ca83675 100644
--- a/src/index.c
+++ b/src/index.c
@@ -959,21 +959,17 @@ MOBI_RET mobi_decode_infl(unsigned char *decoded, int *decoded_size, const unsig
             if (dir == '>') {
                 pos = *decoded_size;
             }
             pos -= c - 10;
             dir = 0;
-            if (pos < 0 || pos > *decoded_size) {
-                debug_print("Position setting failed (%s)\n", decoded);
-                return MOBI_DATA_CORRUPT;
-            }
         }
         else {
             if (mod == 'i') {
                 const unsigned char *s = decoded + pos;
                 unsigned char *d = decoded + pos + 1;
                 const int l = *decoded_size - pos;
-                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
+                if (pos < 0 || l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
                     debug_print("Out of buffer in %s at pos: %i\n", decoded, pos);
                     return MOBI_DATA_CORRUPT;
                 }
                 memmove(d, s, (size_t) l);
                 decoded[pos] = c;
@@ -982,11 +978,11 @@ MOBI_RET mobi_decode_infl(unsigned char *decoded, int *decoded_size, const unsig
             } else {
                 if (dir == '<') { pos--; }
                 const unsigned char *s = decoded + pos + 1;
                 unsigned char *d = decoded + pos;
                 const int l = *decoded_size - pos;
-                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
+                if (pos < 0 || l < 0 || s + l > decoded + INDX_INFLBUF_SIZEMAX) {
                     debug_print("Out of buffer in %s at pos: %i\n", decoded, pos);
                     return MOBI_DATA_CORRUPT;
                 }
                 if (decoded[pos] != c) {
                     debug_print("Character mismatch in %s at pos: %i (%c != %c)\n", decoded, pos, decoded[pos], c);

Vulnerable code:             if (pos < 0 || pos > *decoded_size) {
                debug_print("Position setting failed (%s)\n", decoded);
                return MOBI_DATA_CORRUPT;
            }
                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
Fixed code: 2022-04-27: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input
                if (pos < 0 || l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
                if (pos < 0 || l < 0 || s + l > decoded + INDX_INFLBUF_SIZEMAX) {