X3F parser possible buffer overrun

src/libraw_cxx.cpp

@@ -6098,18 +6098,19 @@ const char *LibRaw::strprogress(enum LibRaw_progress p)
 
 void x3f_clear(void *p) { x3f_delete((x3f_t *)p); }
 
-static char *utf2char(utf16_t *str, char *buffer)
+void utf2char(utf16_t *str, char *buffer, unsigned bufsz)
 {
+ if(bufsz<1) return;
+ buffer[bufsz-1] = 0;
   char *b = buffer;
 
-  while (*str != 0x00)
+  while (*str != 0x00 && --bufsz>0)
   {
     char *chr = (char *)str;
     *b++ = *chr;
     str++;
   }
   *b = 0;
-  return buffer;
 }
 
 static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len)
@@ -6173,8 +6174,8 @@ void LibRaw::parse_x3f()
       for (i = 0; i < PL->num_properties; i++)
       {
         char name[100], value[100];
-        utf2char(P[i].name, name);
-        utf2char(P[i].value, value);
+        utf2char(P[i].name, name,sizeof(name));
+        utf2char(P[i].value, value,sizeof(value));
         if (!strcmp(name, "ISO"))
           imgdata.other.iso_speed = atoi(value);
         if (!strcmp(name, "CAMMANUF"))