Skip to content

Commit efd8cfa

Browse files
committed
X3F parser possible buffer overrun
1 parent 87144aa commit efd8cfa

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

Diff for: src/libraw_cxx.cpp

+7-5
Original file line numberDiff line numberDiff line change
@@ -5484,17 +5484,19 @@ void x3f_clear(void *p)
54845484
x3f_delete((x3f_t*)p);
54855485
}
54865486

5487-
static char *utf2char(utf16_t *str, char *buffer)
5487+
void utf2char(utf16_t *str, char *buffer, unsigned bufsz)
54885488
{
5489+
if(bufsz<1) return;
5490+
buffer[bufsz-1] = 0;
54895491
char *b = buffer;
54905492

5491-
while (*str != 0x00) {
5493+
while (*str != 0x00 && --bufsz>0)
5494+
{
54925495
char *chr = (char *)str;
54935496
*b++ = *chr;
54945497
str++;
54955498
}
54965499
*b = 0;
5497-
return buffer;
54985500
}
54995501

55005502
static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len)
@@ -5555,8 +5557,8 @@ void LibRaw::parse_x3f()
55555557
x3f_property_t *P = PL->property_table.element;
55565558
for (i=0; i<PL->num_properties; i++) {
55575559
char name[100], value[100];
5558-
utf2char(P[i].name,name);
5559-
utf2char(P[i].value,value);
5560+
utf2char(P[i].name,name,sizeof(name));
5561+
utf2char(P[i].value,value,sizeof(value));
55605562
if (!strcmp (name, "ISO"))
55615563
imgdata.other.iso_speed = atoi(value);
55625564
if (!strcmp (name, "CAMMANUF"))

0 commit comments

Comments
 (0)