liblcf v0.8.1 liblcf/lcf2xml: Untrusted LCF data triggers uncaught std::length_error via negative vector resize (DoS)
Posted by Ron E on Aug 18lcf2xml (part of liblcf) aborts when parsing specially crafted RPG Maker
2000/2003 files that supply a negative element count for vectors of
structured records. The generic reader: template void Struct::ReadLcf(std::vector& vec, LcfReader& stream) { int count = stream.ReadInt(); vec.resize(count); // <— negative -> huge size_t -> throws
length_error for (int i = 0; i...
