bzip2recover: Make sure to not process more than BZ_MAX_HANDLED_BLOCKS

There is an off-by-one in the check before calling tooManyBlocks. This
causes the scanning loop to run one more time and cause a possible
read or write one past the global bStart, bEnd, rbStart and rbEnd
buffers. There are no known exploits of this issue and you will need
to compile with something like gcc -fsanitize=address (ASAN
AddressSanitizer) to observe the faulty read/write.

This has been assigned CVE-2026-42250.

1 files changed, 1 insertions, 1 deletions

diff --git a/bzip2recover.c b/bzip2recover.c
index a8131e0..4b1c219 100644
--- a/bzip2recover.c
+++ b/bzip2recover.c
@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
             rbEnd[rbCtr] = bEnd[currBlock];
             rbCtr++;
          }
-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
+         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
          currBlock++;