From 9be257340193dbe3fb810aa33531c40ae9df6414 Mon Sep 17 00:00:00 2001 From: Kevin Backhouse Date: Wed, 30 Jun 2021 16:47:50 +0100 Subject: [PATCH 2/2] Fix incorrect loop condition. --- src/jp2image.cpp | 6 ++++-- .../bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py | 11 +++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/jp2image.cpp b/src/jp2image.cpp index 2cd0a89..58ad5c6 100644 --- a/src/jp2image.cpp +++ b/src/jp2image.cpp @@ -619,11 +619,13 @@ namespace Exiv2 char* p = (char*) boxBuf.pData_; bool bWroteColor = false ; - while ( count < length || !bWroteColor ) { + while ( count < length && !bWroteColor ) { Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ; // copy data. pointer could be into a memory mapped file which we will decode! - Jp2BoxHeader subBox = *pSubBox ; + // pSubBox isn't always an aligned pointer, so use memcpy to do the copy. + Jp2BoxHeader subBox; + memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader)); Jp2BoxHeader newBox = subBox; if ( count < length ) {