diff --git a/src/pngchunk_int.cpp b/src/pngchunk_int.cpp index 7d8aab83..d6dd75a4 100644 --- a/src/pngchunk_int.cpp +++ b/src/pngchunk_int.cpp @@ -64,6 +64,8 @@ namespace Exiv2 { int* outWidth, int* outHeight) { + assert(data.size_ >= 8); + // Extract image width and height from IHDR chunk. *outWidth = getLong((const byte*)data.pData_, bigEndian); diff --git a/src/pngimage.cpp b/src/pngimage.cpp index ba7c68f2..cc93ee23 100644 --- a/src/pngimage.cpp +++ b/src/pngimage.cpp @@ -435,7 +435,9 @@ namespace Exiv2 { #ifdef DEBUG std::cout << "Exiv2::PngImage::readMetadata: Found IHDR chunk (length: " << dataOffset << ")\n"; #endif - PngChunk::decodeIHDRChunk(cdataBuf, &pixelWidth_, &pixelHeight_); + if (cdataBuf.size_ >= 8) { + PngChunk::decodeIHDRChunk(cdataBuf, &pixelWidth_, &pixelHeight_); + } } else if (!memcmp(cheaderBuf.pData_ + 4, "tEXt", 4)) { diff --git a/test/data/issue_170_poc b/test/data/issue_170_poc new file mode 100644 index 00000000..439b7687 Binary files /dev/null and b/test/data/issue_170_poc differ diff --git a/tests/bugfixes/github/test_issue_170.py b/tests/bugfixes/github/test_issue_170.py new file mode 100644 index 00000000..8fd8d7af --- /dev/null +++ b/tests/bugfixes/github/test_issue_170.py @@ -0,0 +1,17 @@ +# -*- coding: utf-8 -*- + +import system_tests + + +class decodeIHDRChunkOutOfBoundsRead(system_tests.Case): + + url = "https://github.com/Exiv2/exiv2/issues/170" + + filename = "{data_path}/issue_170_poc" + + commands = ["{exiv2} " + filename] + stdout = [""] + stderr = ["""{exiv2_exception_msg} """ + filename + """: +{kerFailedToReadImageData} +"""] + retval = [1]