Skip to content

Commit 1334647

Browse files
committed
parse_qt: possible integer overflow
1 parent b90e0d4 commit 1334647

File tree

2 files changed

+4
-0
lines changed

2 files changed

+4
-0
lines changed

Diff for: dcraw/dcraw.c

+2
Original file line numberDiff line numberDiff line change
@@ -13593,6 +13593,8 @@ void CLASS parse_qt (int end)
1359313593
while (ftell(ifp)+7 < end) {
1359413594
save = ftell(ifp);
1359513595
if ((size = get4()) < 8) return;
13596+
if ((int)size < 0) return; // 2+GB is too much
13597+
if (save + size < save) return; // 32bit overflow
1359613598
fread (tag, 4, 1, ifp);
1359713599
if (!memcmp(tag,"moov",4) ||
1359813600
!memcmp(tag,"udta",4) ||

Diff for: internal/dcraw_common.cpp

+2
Original file line numberDiff line numberDiff line change
@@ -12395,6 +12395,8 @@ void CLASS parse_qt (int end)
1239512395
while (ftell(ifp)+7 < end) {
1239612396
save = ftell(ifp);
1239712397
if ((size = get4()) < 8) return;
12398+
if ((int)size < 0) return; // 2+GB is too much
12399+
if (save + size < save) return; // 32bit overflow
1239812400
fread (tag, 4, 1, ifp);
1239912401
if (!memcmp(tag,"moov",4) ||
1240012402
!memcmp(tag,"udta",4) ||

0 commit comments

Comments
 (0)