third_party/exiv2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed potential out of bounds file access

Browse Source 
This commit adds a out-of-bounds protection in the case that the
extracted values for offset & count are summed up larger than the size
of the file. Also this function checks for overflows before performing
the addition.

This fixes #159
This commit is contained in:
Dan Čermák 2017-11-10 15:12:55 +01:00
parent f641f39ab9
commit 36df4bc997
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/image.cpp
View File

@ -73,6 +73,7 @@ EXIV2_RCSID("@(#) $Id$")
#include <cstring>
#include <cassert>
#include <iostream>
#include <limits>
#include <sys/types.h>
#include <sys/stat.h>
@ -459,6 +460,12 @@ namespace Exiv2 {
io.seek(restore,BasicIo::beg);
}
} else if ( option == kpsRecursive && tag == 0x83bb /* IPTCNAA */ ) {
if (offset > std::numeric_limits<uint32_t>::max() - count) {
throw Error(59);
}
if (static_cast<size_t>(offset + count) > io.size()) {
throw Error(58);
}
size_t restore = io.tell(); // save
io.seek(offset,BasicIo::beg); // position
byte* bytes=new byte[count] ; // allocate memory