31 lines
1.2 KiB
Diff
31 lines
1.2 KiB
Diff
From 9be257340193dbe3fb810aa33531c40ae9df6414 Mon Sep 17 00:00:00 2001
|
|
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
Date: Wed, 30 Jun 2021 16:47:50 +0100
|
|
Subject: [PATCH 2/2] Fix incorrect loop condition.
|
|
|
|
---
|
|
src/jp2image.cpp | 6 ++++--
|
|
.../bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py | 11 +++++------
|
|
2 files changed, 9 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
|
|
index 2cd0a89..58ad5c6 100644
|
|
--- a/src/jp2image.cpp
|
|
+++ b/src/jp2image.cpp
|
|
@@ -619,11 +619,13 @@ namespace Exiv2
|
|
char* p = (char*) boxBuf.pData_;
|
|
bool bWroteColor = false ;
|
|
|
|
- while ( count < length || !bWroteColor ) {
|
|
+ while ( count < length && !bWroteColor ) {
|
|
Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;
|
|
|
|
// copy data. pointer could be into a memory mapped file which we will decode!
|
|
- Jp2BoxHeader subBox = *pSubBox ;
|
|
+ // pSubBox isn't always an aligned pointer, so use memcpy to do the copy.
|
|
+ Jp2BoxHeader subBox;
|
|
+ memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader));
|
|
Jp2BoxHeader newBox = subBox;
|
|
|
|
if ( count < length ) {
|