MacKwnoX/NX2navi
1
0
Fork 0
mirror of https://github.com/tangerineturtle1/NX2navi.git synced 2026-11-15 17:09:57 -04:00
Code Issues Packages Projects Releases Wiki Activity

Check a .nup table of contents against the file size before reading it.

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chrg6
2026-11-09 05:57:21 -05:00
parent 984a5f021a
commit 7ee5ce195e
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tools/nup.py
View File

@@ -39,6 +39,9 @@ class Nup:
magic, _a, _b, toc_off, toc_size, toc_sha, _blob, _size, _count, _z, _uid, _zeros = SUPER.unpack(head)
if magic != b'NUP\x01':
raise NupError(f'not a .nup file (magic {magic!r})')
end = f.seek(0, 2)
if toc_off > end or toc_size > end - toc_off: # read no more than the file holds, whatever the header says
raise NupError('the table of contents is damaged (it lies past the end of the file)')
f.seek(toc_off)
toc = f.read(toc_size)
if len(toc) != toc_size or hashlib.sha256(toc).digest() != toc_sha: