Posted by Ron E on Sep 15A vulnerability exists in CHMLib (latest release 0.40) when parsing malformed CHM (Compiled HTML Help) files. The functions _unmarshal_int32 and _unmarshal_uint32 reconstruct 32-bit values using left shifts on signed integers without proper type casting: dest = (pData)[0] | (pData)[1]<<8 | (pData)[2]<<16 | (*pData)[3]<<24; If an attacker supplies crafted input such that the most significant byte is 0xFF, this triggers a left...