1818 * Foundation, Inc., 51 Franklin Street, 5th Floor, Boston, MA 02110-1301 USA.
1919 */
2020
21- /*
22- File: jp2image.cpp
23- */
24-
2521// *****************************************************************************
2622
2723// included header files
@@ -197,6 +193,16 @@ namespace Exiv2
197193 return result;
198194 }
199195
196+ static void boxes_check (size_t b,size_t m)
197+ {
198+ if ( b > m ) {
199+ #ifdef EXIV2_DEBUG_MESSAGES
200+ std::cout << " Exiv2::Jp2Image::readMetadata box maximum exceeded" << std::endl;
201+ #endif
202+ throw Error (kerCorruptedMetadata);
203+ }
204+ }
205+
200206 void Jp2Image::readMetadata ()
201207 {
202208#ifdef EXIV2_DEBUG_MESSAGES
@@ -219,9 +225,12 @@ namespace Exiv2
219225 Jp2BoxHeader subBox = {0 ,0 };
220226 Jp2ImageHeaderBox ihdr = {0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 };
221227 Jp2UuidBox uuid = {{0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 }};
228+ size_t boxes = 0 ;
229+ size_t boxem = 1000 ; // boxes max
222230
223231 while (io_->read ((byte*)&box, sizeof (box)) == sizeof (box))
224232 {
233+ boxes_check (boxes++,boxem );
225234 position = io_->tell ();
226235 box.length = getLong ((byte*)&box.length , bigEndian);
227236 box.type = getLong ((byte*)&box.type , bigEndian);
@@ -251,8 +260,12 @@ namespace Exiv2
251260
252261 while (io_->read ((byte*)&subBox, sizeof (subBox)) == sizeof (subBox) && subBox.length )
253262 {
263+ boxes_check (boxes++, boxem) ;
254264 subBox.length = getLong ((byte*)&subBox.length , bigEndian);
255265 subBox.type = getLong ((byte*)&subBox.type , bigEndian);
266+ if (subBox.length > io_->size () ) {
267+ throw Error (kerCorruptedMetadata);
268+ }
256269#ifdef EXIV2_DEBUG_MESSAGES
257270 std::cout << " Exiv2::Jp2Image::readMetadata: "
258271 << " subBox = " << toAscii (subBox.type ) << " length = " << subBox.length << std::endl;
@@ -308,7 +321,9 @@ namespace Exiv2
308321 }
309322
310323 io_->seek (restore,BasicIo::beg);
311- io_->seek (subBox.length , Exiv2::BasicIo::cur);
324+ if ( io_->seek (subBox.length , Exiv2::BasicIo::cur) != 0 ) {
325+ throw Error (kerCorruptedMetadata);
326+ }
312327 restore = io_->tell ();
313328 }
314329 break ;
0 commit comments