Found via fuzzing;
https://github.com/elfmaster/libelfmaster/blob/85e949c51b219594c0b3f4014cb09037f1442996/src/inte
rnal.c#L1329
This check will cause a malformed object to perform a (0 - 0) - 6 which will cause a very large number to be compared against i. Resulting in crashes often when ins[i] is used by the memcmp -- there needs to be a check to prevent this, likely returning 0.
Unsure if this needs to throw / catch extra issues downstream?
Found via fuzzing;
https://github.com/elfmaster/libelfmaster/blob/85e949c51b219594c0b3f4014cb09037f1442996/src/inte
rnal.c#L1329
This check will cause a malformed object to perform a
(0 - 0) - 6which will cause a very large number to be compared againsti. Resulting in crashes often whenins[i]is used by thememcmp-- there needs to be a check to prevent this, likely returning0.Unsure if this needs to throw / catch extra issues downstream?