Protect against short map section

icza · Oct 18, 2024 · c52cea3 · c52cea3
1 parent 9103d58
commit c52cea3
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/cmd/screp/screp.go b/cmd/screp/screp.go
@@ -24,7 +24,7 @@ import (
 
 const (
 	appName    = "screp"
-	appVersion = "v1.12.2"
+	appVersion = "v1.12.3"
 	appAuthor  = "Andras Belicza"
 	appHome    = "https://github.com/icza/screp"
 )

diff --git a/repparser/repparser.go b/repparser/repparser.go
@@ -60,7 +60,7 @@ import (
 
 const (
 	// Version is a Semver2 compatible version of the parser.
-	Version = "v1.12.2"
+	Version = "v1.12.3"
 )
 
 var (
@@ -791,6 +791,10 @@ func parseMapData(data []byte, r *rep.Replay, cfg Config) error {
 	// Map data section is a sequence of sub-sections:
 	for sr, size := (sliceReader{b: data}), uint32(len(data)); sr.pos < size; {
 		id := sr.getString(4)
+		// Seen examples where a "final" UPUS section following UPRP section had only 1 byte hereon, so check:
+		if sr.pos+4 >= size {
+			break
+		}
 		ssSize := sr.getUint32()    // sub-section size (remaining)
 		ssEndPos := sr.pos + ssSize // sub-section end position