From 61734d8842cb9cc59437463e3bac54d6231d9487 Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Tue, 18 May 2021 10:52:54 +0900 Subject: [PATCH] modify Signed-off-by: Wang Mingyu --- src/jp2image.cpp | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/jp2image.cpp b/src/jp2image.cpp index 52723a4..0ac4f50 100644 --- a/src/jp2image.cpp +++ b/src/jp2image.cpp @@ -643,11 +643,11 @@ static void boxes_check(size_t b,size_t m) void Jp2Image::encodeJp2Header(const DataBuf& boxBuf,DataBuf& outBuf) { DataBuf output(boxBuf.size_ + iccProfile_.size_ + 100); // allocate sufficient space - int outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output? - int inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf? + long outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output? + long inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf? Jp2BoxHeader* pBox = (Jp2BoxHeader*) boxBuf.pData_; - int32_t length = getLong((byte*)&pBox->length, bigEndian); - int32_t count = sizeof (Jp2BoxHeader); + uint32_t length = getLong((byte*)&pBox->length, bigEndian); + uint32_t count = sizeof (Jp2BoxHeader); char* p = (char*) boxBuf.pData_; bool bWroteColor = false ; @@ -664,6 +664,7 @@ static void boxes_check(size_t b,size_t m) #ifdef EXIV2_DEBUG_MESSAGES std::cout << "Jp2Image::encodeJp2Header subbox: "<< toAscii(subBox.type) << " length = " << subBox.length << std::endl; #endif + enforce(subBox.length <= length - count, Exiv2::kerCorruptedMetadata); count += subBox.length; newBox.type = subBox.type; } else { @@ -672,12 +673,13 @@ static void boxes_check(size_t b,size_t m) count = length; } - int32_t newlen = subBox.length; + uint32_t newlen = subBox.length; if ( newBox.type == kJp2BoxTypeColorHeader ) { bWroteColor = true ; if ( ! iccProfileDefined() ) { const char* pad = "\x01\x00\x00\x00\x00\x00\x10\x00\x00\x05\x1cuuid"; uint32_t psize = 15; + enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata); ul2Data((byte*)&newBox.length,psize ,bigEndian); ul2Data((byte*)&newBox.type ,newBox.type,bigEndian); ::memcpy(output.pData_+outlen ,&newBox ,sizeof(newBox)); @@ -686,6 +688,7 @@ static void boxes_check(size_t b,size_t m) } else { const char* pad = "\0x02\x00\x00"; uint32_t psize = 3; + enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata); ul2Data((byte*)&newBox.length,psize+iccProfile_.size_,bigEndian); ul2Data((byte*)&newBox.type,newBox.type,bigEndian); ::memcpy(output.pData_+outlen ,&newBox ,sizeof(newBox) ); @@ -694,6 +697,7 @@ static void boxes_check(size_t b,size_t m) newlen = psize + iccProfile_.size_; } } else { + enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata); ::memcpy(output.pData_+outlen,boxBuf.pData_+inlen,subBox.length); } -- 2.25.1