Skip to content

Commit

Permalink
Fix crashes due to malicious RPFs
Browse files Browse the repository at this point in the history
RpfFile:
- Limit RPF entry names to 256 characters because long names can cause the RPFExplorer to freeze when opening its directory.
- Skip RPFs with paths longer that 5000 characters, which are probably an attempt to make CW run out-of-memory.

ExploreForm:
- Use `Path.GetExtension` directly instead of `FileInfo` to prevent `PathTooLongException`s.
- Check for invalid characters in file names to prevent `ArgumentException`s.
  • Loading branch information
alexguirre committed Aug 12, 2023
1 parent 9d76f2c commit 118305e
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 3 deletions.
7 changes: 6 additions & 1 deletion CodeWalker.Core/GameFiles/RpfFile.cs
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,11 @@ private void ReadHeader(BinaryReader br)

namesrdr.Position = e.NameOffset;
e.Name = namesrdr.ReadString();
if (e.Name.Length > 256)
{
// long names can freeze the RPFExplorer
e.Name = e.Name.Substring(0, 256);
}
e.NameLower = e.Name.ToLowerInvariant();

if ((e is RpfFileEntry) && string.IsNullOrEmpty(e.Name))
Expand Down Expand Up @@ -312,7 +317,7 @@ private void ScanStructure(BinaryReader br, Action<string> updateStatus, Action<

//search all the sub resources for YSC files. (recurse!)
string lname = binentry.NameLower;
if (lname.EndsWith(".rpf"))
if (lname.EndsWith(".rpf") && binentry.Path.Length < 5000) // a long path is most likely an attempt to crash CW, so skip it
{
br.BaseStream.Position = StartPos + ((long)binentry.FileOffset * 512);

Expand Down
9 changes: 7 additions & 2 deletions CodeWalker/ExploreForm.cs
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ public partial class ExploreForm : Form
private volatile bool Ready = false;

private Dictionary<string, FileTypeInfo> FileTypes;
private readonly char[] InvalidFileNameChars = Path.GetInvalidFileNameChars();

private MainTreeFolder RootFolder;
private List<MainTreeFolder> ExtraRootFolders = new List<MainTreeFolder>();
Expand Down Expand Up @@ -333,8 +334,12 @@ private void InitSubFileType(string ext, string subext, string name, int imgidx,
}
public FileTypeInfo GetFileType(string fn)
{
var fi = new FileInfo(fn);
var ext = fi.Extension.ToLowerInvariant();
if (fn.IndexOfAny(InvalidFileNameChars) != -1)
{
return FileTypes[""];
}

var ext = Path.GetExtension(fn).ToLowerInvariant();
if (!string.IsNullOrEmpty(ext))
{
FileTypeInfo ft;
Expand Down

0 comments on commit 118305e

Please sign in to comment.