Merge pull request #1534 from Exiv2/fix_1529

Fix out of buffer access in #1529
Exiv2 · Apr 9, 2021 · 0230620 · 0230620
2 parents 05ec053 + 13e5a3e
commit 0230620
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
@@ -776,9 +776,10 @@ static void boxes_check(size_t b,size_t m)
 #endif
                 box.length = (uint32_t) (io_->size() - io_->tell() + 8);
             }
-            if (box.length == 1)
+            if (box.length < 8)
             {
-                // FIXME. Special case. the real box size is given in another place.
+                // box is broken, so there is nothing we can do here
+                throw Error(kerCorruptedMetadata);
             }
 
             // Read whole box : Box header + Box data (not fixed size - can be null).