Fix the 32-bit overflow in the PawnIOUtil blob parser
sigsize + 4 + 6 was computed in 32 bits and wrapped, while input.begin() + 4 + sigsize promotes to 64 bits and does not. A nine-byte file of FF FF FF FF 00 00 00 E1 F1 therefore satisfied every guard and then built a vector spanning roughly 4 GB from a nine-byte heap block. Reachable from sign, test and interactive. Widening sigsize to size_t makes the bounds check the 64-bit computation the indexing already was. The driver copy of the same parse was already correct.
N
namazso committed
b0c8134de473ab3be599b9a2aa16fa16383355cd
Parent: 35a01b0