38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 06aa7ab69d0c4f3d14644bd84fc9d1346154430d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dan.cermak@cgc-instruments.com>
|
|
Date: Mon, 22 Jan 2018 23:56:08 +0100
|
|
Subject: Fix out of bounds read in src/pngchunk_int.cpp by @brianmay
|
|
|
|
- consider that key is advanced by 8 bytes if stripHeader is true
|
|
=> length is reduced by same amount
|
|
Fixed by adding offset to the check in the loop
|
|
- Rewrote loop so that keysize is checked before the next
|
|
iteration (preventing an out of bounds read)
|
|
|
|
diff --git a/src/pngchunk.cpp b/src/pngchunk.cpp
|
|
index da4ccd01..b54bcdac 100644
|
|
--- a/src/pngchunk.cpp
|
|
+++ b/src/pngchunk.cpp
|
|
@@ -107,15 +107,17 @@ namespace Exiv2 {
|
|
{
|
|
// From a tEXt, zTXt, or iTXt chunk,
|
|
// we get the key, it's a null terminated string at the chunk start
|
|
- if (data.size_ <= (stripHeader ? 8 : 0)) throw Error(14);
|
|
- const byte *key = data.pData_ + (stripHeader ? 8 : 0);
|
|
+ const int offset = stripHeader ? 8 : 0;
|
|
+ if (data.size_ <= offset) throw Error(14);
|
|
+ const byte *key = data.pData_ + offset;
|
|
|
|
// Find null string at end of key.
|
|
int keysize=0;
|
|
- for ( ; key[keysize] != 0 ; keysize++)
|
|
+ while (key[keysize] != 0)
|
|
{
|
|
+ keysize++;
|
|
// look if keysize is valid.
|
|
- if (keysize >= data.size_)
|
|
+ if (keysize+offset >= data.size_)
|
|
throw Error(14);
|
|
}
|
|
|