@@ -, +, @@ Specifically validate region tag on header import - Region tags need to have very specific content, the generic header tag checks are not sufficient to ensure sanity. Verify the tag is one of the known region tags and that the entry has expected type and count. --- a/lib/header.c +++ a/lib/header.c @@ -814,10 +814,13 @@ Header headerLoad(void * uh) entry->info.type = htonl(pe->type); entry->info.count = htonl(pe->count); + entry->info.tag = htonl(pe->tag); - if (hdrchkType(entry->info.type)) + if (!ENTRY_IS_REGION(entry)) + goto errxit; + if (entry->info.type != REGION_TAG_TYPE) goto errxit; - if (hdrchkTags(entry->info.count)) + if (entry->info.count != REGION_TAG_COUNT) goto errxit; { int off = ntohl(pe->offset); @@ -833,7 +836,6 @@ Header headerLoad(void * uh) ril = rdl/sizeof(*pe); if (hdrchkTags(ril) || hdrchkData(rdl)) goto errxit; - entry->info.tag = htonl(pe->tag); } else { ril = il; rdl = (ril * sizeof(struct entryInfo_s));