liblcf v0.8.1 liblcf/lcf2xml: Untrusted LCF data triggers uncaught std::length_error via negative vector resize (DoS)  – Full Disclosure

Posted by Ron E on Aug 18

lcf2xml (part of liblcf) aborts when parsing specially crafted RPG Maker
2000/2003 files that supply a negative element count for vectors of
structured records. The generic reader:

template <class S>

void Struct<S>::ReadLcf(std::vector<S>& vec, LcfReader& stream) {

int count = stream.ReadInt();

vec.resize(count); // <— negative -> huge size_t -> throws
length_error

for (int i = 0; i…
 – Read More  – Full Disclosure