Buffer overflow in gigimport?
opened this issue · comments
The function gigimport at https://github.com/xqemu/xbedump/blob/master/xboxlib.c#L187 is performing a memcpy from buff to g->n. In my case, gigimport is being called from decrypt_signature which is passing c_number as buff that is header->HeaderSignature. This is a 256 bytes array, but g->n is only an unsigned short, so this should overflow. This same function breaks the tool on Windows but not on Ubuntu. It’s because, in the for loop below, g->n[count] is zero on Ubuntu but not on Windows and so it will +1 g->sign which will lead to an incorrect decryption and signature failure.
Update: applying the gigimport implementation suggested here fixes the tool on Windows
http://xbox-linux-devel.narkive.com/Qw6o31DP/xbedump-fix-for-array-out-of-bounds-access#post1
Please submit a PR if you've found a bug :)
Closed or worked around in #5