cottongin/crosspoint-reader
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 4 Wiki Activity

Add bounds checking for toc and spine array access

Browse Source 
getSpineIndexForTocIndex() and getTocIndexForSpineIndex() accessed
toc[tocIndex] and spine[spineIndex] without validating the index
was within bounds. This could cause crashes with malformed EPUBs
or unexpected input.
This commit is contained in:
IFAKA 2025-12-19 01:08:29 +01:00
parent d86b3fe134
commit 8bf203d0ea
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/Epub/Epub.cpp
View File

@ -322,6 +322,11 @@ int Epub::getTocItemsCount() const { return toc.size(); }
// work out the section index for a toc index // work out the section index for a toc index
int Epub::getSpineIndexForTocIndex(const int tocIndex) const { int Epub::getSpineIndexForTocIndex(const int tocIndex) const {
if (tocIndex < 0 || tocIndex >= toc.size()) {
Serial.printf("[%lu] [EBP] getSpineIndexForTocIndex: tocIndex %d out of range\n", millis(), tocIndex);
return 0;
}
// the toc entry should have an href that matches the spine item // the toc entry should have an href that matches the spine item
// so we can find the spine index by looking for the href // so we can find the spine index by looking for the href
for (int i = 0; i < spine.size(); i++) { for (int i = 0; i < spine.size(); i++) {
@ -336,6 +341,11 @@ int Epub::getSpineIndexForTocIndex(const int tocIndex) const {
} }
int Epub::getTocIndexForSpineIndex(const int spineIndex) const { int Epub::getTocIndexForSpineIndex(const int spineIndex) const {
if (spineIndex < 0 || spineIndex >= spine.size()) {
Serial.printf("[%lu] [EBP] getTocIndexForSpineIndex: spineIndex %d out of range\n", millis(), spineIndex);
return -1;
}
// the toc entry should have an href that matches the spine item // the toc entry should have an href that matches the spine item
// so we can find the toc index by looking for the href // so we can find the toc index by looking for the href
for (int i = 0; i < toc.size(); i++) { for (int i = 0; i < toc.size(); i++) {