Fix CVE-2018-20536 and CVE-2018-20539 (#183)

libLAS · Apr 14, 2020 · ca88a11 · ca88a11
1 parent d76a061
commit ca88a11
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/src/spatialreference.cpp b/src/spatialreference.cpp
@@ -510,12 +510,16 @@ const GTIF* SpatialReference::GetGTIF()
 #pragma pack(pop)
 
             ShortKeyHeader *header = (ShortKeyHeader *)data.data();
-            // Calculate the number of shorts in the VLR data.
-            // The '+ 1' accounts for the header itself.
-            int count = (header->numKeys + 1) * 4;
-            short *data_s = reinterpret_cast<short *>( &(data[0]));
-
-            ST_SetKey(m_tiff, record.GetRecordId(), count, STT_SHORT, data_s);
+            if (header)
+            {
+                // Calculate the number of shorts in the VLR data.
+                // The '+ 1' accounts for the header itself.
+                int count = (header->numKeys + 1) * 4;
+                short *data_s = reinterpret_cast<short *>( &(data[0]));
+                if(std::size_t(count) <= data.size() / sizeof(short)) {
+                    ST_SetKey(m_tiff, record.GetRecordId(), count, STT_SHORT, data_s);
+                }
+            }
         }
 
         if (uid == record.GetUserId(true).c_str() &&