From 02da55298112c1f9ab1fd35a3c2c7753de33338c Mon Sep 17 00:00:00 2001
From: npt-1707 <npthanh132@gmail.com>
Date: Mon, 21 Apr 2025 23:21:26 +0800
Subject: [PATCH] fixing potential OOB window write when unpacking chm files

---
 third_party/mspack/lzxd.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/third_party/mspack/lzxd.c b/third_party/mspack/lzxd.c
index 548366409..e54c4906d 100644
--- a/third_party/mspack/lzxd.c
+++ b/third_party/mspack/lzxd.c
@@ -781,6 +781,10 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
       case LZX_BLOCKTYPE_UNCOMPRESSED:
         /* as this_run is limited not to wrap a frame, this also means it
          * won't wrap the window (as the window is a multiple of 32k) */
+        if (window_posn + this_run > lzx->window_size) {
+                D(("match ran over window boundary"))
+                return lzx->error = MSPACK_ERR_DECRUNCH;
+        }
         rundest = &window[window_posn];
         window_posn += this_run;
         while (this_run > 0) {
@@ -903,8 +907,10 @@ void lzxd_free(struct lzxd_stream *lzx) {
   struct mspack_system *sys;
   if (lzx) {
     sys = lzx->sys;
-    sys->free(lzx->inbuf);
-    sys->free(lzx->window);
+    if(lzx->inbuf)
+        sys->free(lzx->inbuf);
+    if(lzx->window)
+        sys->free(lzx->window);
     sys->free(lzx);
   }
 }