fixed: Incorrect length calculation for keywords from IPTC tags in wh…

…ich could result in a buffer overflow.
xbmc · Dec 21, 2013 · 1e0e02e · 1e0e02e
1 parent e5c9656
commit 1e0e02e
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/libexif/IptcParse.cpp b/lib/libexif/IptcParse.cpp
@@ -201,8 +201,10 @@ bool CIptcParse::Process (const unsigned char* const Data, const unsigned short
         // there may be multiple keywords - lets join them
         size_t maxLen = MAX_IPTC_STRING - strlen(tag);
         if (maxLen > 2)
+        {
           strcat(tag, ", ");
-        strncat(tag, pos, min(length, MAX_IPTC_STRING - maxLen - 3));
+          strncat(tag, pos, min(length, maxLen - 3));
+        }
       }
 /*      if (id == SLIDE_IPTC_CAPTION)
       {