rpms/libexif
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix the patch s/ds/size

Browse Source
This commit is contained in:
Marco Pesenti Gritti 2005-03-08 10:46:40 +00:00
parent 8053fc4c5a
commit 94b50bd7a3
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libexif-0.5.12-buffer-overflow.patch
View File

@ -13,7 +13,7 @@
printf ("IFD 0 at %i.\n", (int) offset);
#endif
+ if (ds < 6 + 4 + offset)
+ if (size < 6 + 4 + offset)
+ return;
+
/* Parse the actual exif data (offset 14) */
@ -22,7 +22,7 @@
/* IFD 1 offset */
n = exif_get_short (d + 6 + offset, data->priv->order);
+ if (ds < 6 + offset + 2 + 12 * n + 4)
+ if (size < 6 + offset + 2 + 12 * n + 4)
+ return;
+
offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);