3c72a01f6b
Resolves: bz#1993247 Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header Resolves: bz#1993284
30 lines
1.4 KiB
Diff
30 lines
1.4 KiB
Diff
From dbf472751fc8b87ea7d1de02f54eaf64233a2fb6 Mon Sep 17 00:00:00 2001
|
|
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
Date: Mon, 5 Jul 2021 10:40:03 +0100
|
|
Subject: [PATCH 2/2] Better bounds checking in Jp2Image::printStructure
|
|
|
|
---
|
|
src/jp2image.cpp | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
|
|
index 3bf356629..2d6dc2118 100644
|
|
--- a/src/jp2image.cpp
|
|
+++ b/src/jp2image.cpp
|
|
@@ -538,6 +538,7 @@ static void boxes_check(size_t b,size_t m)
|
|
|
|
if (subBox.type == kJp2BoxTypeColorHeader) {
|
|
long pad = 3; // don't know why there are 3 padding bytes
|
|
+ enforce(data.size_ >= pad, kerCorruptedMetadata);
|
|
if (bPrint) {
|
|
out << " | pad:";
|
|
for (int i = 0; i < 3; i++)
|
|
@@ -547,6 +548,7 @@ static void boxes_check(size_t b,size_t m)
|
|
if (bPrint) {
|
|
out << " | iccLength:" << iccLength;
|
|
}
|
|
+ enforce(iccLength <= data.size_ - pad, kerCorruptedMetadata);
|
|
if (bICC) {
|
|
out.write((const char*)data.pData_ + pad, iccLength);
|
|
}
|