#165 Out of bounds read in CabHandler.cpp CFolderOutStream::OpenFile()

[Sean Burford]

The attached test case causes CFolderOutStream::OpenFile() to index item 49 (the value of mvItem2.ItemIndex) out of a vector of 4 entries (the number of Items). This causes a segfault on one of these lines depending on what's in memory:

      const CItem &item2 = m_Database->Volumes[mvItem2.VolumeIndex].Items[mvItem2.ItemIndex];
      if (item.Offset != item2.Offset ||
          item.Size != item2.Size ||
          item.Size == 0)

Here's p7zip's output:

p7zip_15.09/bin/7za t crashes/4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21 

7-Zip (a) [32] 15.09 beta : Copyright (c) 1999-2015 Igor Pavlov : 2015-10-16
p7zip Version 15.09 beta (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,32 bits,6 CPUs x86)

Scanning the drive for archives:
1 file, 122 bytes (1 KiB)

Testing archive: crashes/4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21

ERRORS:
Unexpected end of archive
ERRORS:
Can't open volume: 

--
Path = crashes/4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21
Type = Cab
ERRORS:
Unexpected end of archive
ERROR = Can't open volume: 
Offset = 46
Physical Size = 1073741824
Method = None 13
Blocks = 4
Volumes = 1
Volume Index = 0
ID = 5

  0%
ERROR: Unsupported Method : 4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21~
ERROR: Unsupported Method : 4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21~
 50% T 4f58130351e0055d4686a93ef3d7ec5ac318b9a9eb5aa823194a556ccbf29a21~
Segmentation fault

[Igor Pavlov]

Fixed code:
CabIn.cpp:

  FOR_VECTOR (i, Items)
  {
    int folderIndex = GetFolderIndex(&Items[i]);
    while (folderIndex >= (int)FolderStartFileIndex.Size())
      FolderStartFileIndex.Add(i);
  }