add r2007 Page out of bounds check

Fixes case 1 of GH #179
LibreDWG · Jan 3, 2020 · fc8c16c · fc8c16c
1 parent 5c19f59
commit fc8c16c
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/decode_r2007.c b/src/decode_r2007.c
@@ -1010,6 +1010,13 @@ read_pages_map (Bit_Chain *dat, int64_t size_comp, int64_t size_uncomp,
           pages_destroy (pages);
           return NULL;
         }
+      if (ptr + 16 > ptr_end)
+        {
+          LOG_ERROR ("Page out of bounds")
+          free (data);
+          pages_destroy (pages);
+          return NULL;
+        }
 
       page->size = bfr_read_uint64 (ptr);
       page->id = bfr_read_int64 (ptr);