@@ -156,7 +156,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
156156{
157157 DWORD dwMemLength;
158158 LPCBYTE lpMemFile;
159- LPBYTE pBuffer, pEnd ;
159+ LPBYTE pBuffer,pBufEnd ;
160160 LPMMCMPFILEHEADER pmfh;
161161 LPMMCMPHEADER pmmh;
162162 const DWORD *pblk_table;
@@ -186,7 +186,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
186186 dwFileSize = pmmh->filesize ;
187187 if ((pBuffer = (LPBYTE)GlobalAllocPtr (GHND, (dwFileSize + 31 ) & ~15 )) == NULL )
188188 return FALSE ;
189- pEnd = pBuffer + dwFileSize;
189+ pBufEnd = pBuffer + dwFileSize;
190190 pblk_table = (const DWORD *)(lpMemFile+pmmh->blktable );
191191 for (UINT nBlock=0 ; nBlock<pmmh->nblocks ; nBlock++)
192192 {
@@ -195,7 +195,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
195195 LPMMCMPBLOCK pblk;
196196 LPMMCMPSUBBLOCK psubblk;
197197
198- if (dwMemPos + 20 >= dwMemLength)
198+ if (dwMemPos >= dwMemLength - 20 )
199199 goto err;
200200 memcpy (tmp1,lpMemFile+dwMemPos,28 );
201201 pblk = (LPMMCMPBLOCK)(tmp1);
@@ -207,7 +207,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
207207 goto err;
208208 if (pblk->pk_size <= pblk->tt_entries )
209209 goto err;
210- if (dwMemPos + 20 + pblk->sub_blk *8 >= dwMemLength)
210+ if (pblk->sub_blk *8 >= dwMemLength - dwMemPos - 20 )
211211 goto err;
212212 if (pblk->flags & MMCMP_COMP) {
213213 if (pblk->flags & MMCMP_16BIT) {
@@ -303,7 +303,7 @@ BOOL MMCMP_Unpack(LPCBYTE *ppMemFile, LPDWORD pdwMemLength)
303303 {
304304 newval ^= 0x8000 ;
305305 }
306- if (pEnd - pDest < 2 ) goto err;
306+ if (pBufEnd - pDest < 2 ) goto err;
307307 dwPos += 2 ;
308308 *pDest++ = (BYTE) (((WORD)newval) & 0xff );
309309 *pDest++ = (BYTE) (((WORD)newval) >> 8 );
0 commit comments