Sanity check region length on header load

- Region size can't obviously be larger than the containing header,
  sanity check to avoid crashes from malformed packages.
- We should really test for length equality here, but with dribbles
  the size is sometimes off by three, whatever the reason (bug likely),
  leaving that investigation for some sunnier day...

1 files changed, 5 insertions, 0 deletions

diff --git a/lib/header.c b/lib/header.c
index c77196749..b01d1e48b 100644
--- a/lib/header.c
+++ b/lib/header.c
@@ -895,6 +895,11 @@ Header headerLoad(void * uh)
 	    h->indexUsed += ne;
 	  }
 	}
+
+	rdlen += REGION_TAG_COUNT;
+	/* XXX should be equality test, but dribbles are sometimes a bit off? */
+	if (rdlen > dl || (rdlen < dl && ril == h->indexUsed))
+	    goto errxit;
     }
 
     h->flags &= ~HEADERFLAG_SORTED;