Fix infinite loop in Image::printIFDStructure #1778
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kevinbackhouse
added
the
forward-to-main
|
This pull request introduces 1 alert and fixes 1 when merging d9fd4c4 into 4af6e40 - view on LGTM.com new alerts:
fixed alerts:
|
hassec
approved these changes
Jul 15, 2021
kevinbackhouse
added a commit
that referenced
this pull request
Jul 16, 2021
Fix infinite loop in Image::printIFDStructure (backport #1778)
Open
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-m479-7frc-gqqg
The problem is that this loop can be infinite when dirLength is zero. If
dirLength > 0then the loop cannot be infinite because the algorithm uses a set namedvisitsto make sure that the same location is never visited twice. I am not an expert on this format, but it seems unlikely to me thatdirLength == 0is ever valid, so disallowing that is a simple way to fix the bug.The second commit fixes the bug.
I didn't like the look of some of the parsing code in this function, so I added a third commit which adds more error checking.