Better bounds checking in Jp2Image::printStructure

(cherry picked from commit 0fcdde80997913dde284ea98f06f9305d06cb160)
2021-07-05 10:40:03 +01:00
parent e486a7313e
commit ff00771425
1 changed files with 2 additions and 0 deletions
@@ -537,6 +537,7 @@ static void boxes_check(size_t b,size_t m)

                            if (subBox.type == kJp2BoxTypeColorHeader) {
                                long pad = 3;  // don't know why there are 3 padding bytes
+                                enforce(data.size_ >= pad, kerCorruptedMetadata);
                                if (bPrint) {
                                    out << " | pad:";
                                    for (int i = 0; i < 3; i++)
@@ -546,6 +547,7 @@ static void boxes_check(size_t b,size_t m)
                                if (bPrint) {
                                    out << " | iccLength:" << iccLength;
                                }
+                                enforce(iccLength <= data.size_ - pad, kerCorruptedMetadata);
                                if (bICC) {
                                    out.write(reinterpret_cast<const char*>(data.pData_) + pad, iccLength);
                                }