unprotbas: check for bad memmove and too-small input file.

1 files changed, 16 insertions, 1 deletions

diff --git a/unprotbas.c b/unprotbas.c
index 0b11e0e..16fbea5 100644
--- a/unprotbas.c
+++ b/unprotbas.c
@@ -16,6 +16,12 @@
 
 #define STM_OFFSET 0xf2
 
+/* minimum program size, for a program that has no variables and
+	only one line of code (the immediate line 32768, consisting only of
+	one token, which would be CSAVE). anything smaller than this, we
+	can't process. */
+#define MIN_PROG_SIZE 21
+
 /* entire file gets read into memory (for now) */
 unsigned char data[65536];
 
@@ -60,6 +66,8 @@ int readfile(void) {
 	int got = fread(data, 1, 65535, input_file);
 	if(verbose) fprintf(stderr, "read %d bytes\n", got);
 	fclose(input_file);
+	if(got < MIN_PROG_SIZE)
+		die("File too short to be a BASIC program (truncated?)\n");
 	return got;
 }
 
@@ -194,7 +202,14 @@ int fixcode(void) {
 	by moving the rest of the program (including the variable value
 	table) up in memory. */
 void move_code(int offset) {
-	memmove(data + vvstart + offset, data + vvstart, filelen);
+	unsigned char *dest = data + vvstart + offset;
+
+	if(dest < data || (filelen + offset) > 65535) {
+		die("attempt to move memory out of range; corrupt header bytes?\n");
+	}
+
+	memmove(dest, data + vvstart, filelen);
+
 	vntd += offset;
 	vvtp += offset;
 	stmtab += offset;