diff --git a/libexif-0.5.12-buffer-overflow.patch b/libexif-0.5.12-buffer-overflow.patch index 078605f..7621c49 100644 --- a/libexif-0.5.12-buffer-overflow.patch +++ b/libexif-0.5.12-buffer-overflow.patch @@ -13,7 +13,7 @@ printf ("IFD 0 at %i.\n", (int) offset); #endif -+ if (ds < 6 + 4 + offset) ++ if (size < 6 + 4 + offset) + return; + /* Parse the actual exif data (offset 14) */ @@ -22,7 +22,7 @@ /* IFD 1 offset */ n = exif_get_short (d + 6 + offset, data->priv->order); -+ if (ds < 6 + offset + 2 + 12 * n + 4) ++ if (size < 6 + offset + 2 + 12 * n + 4) + return; + offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);