File Added-check-for-overflows-in-calculation-of-size.patch of Package exiv2.7392
From dd3ad852820503422de73b2e0793c8b4b0f45a5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dan.cermak@cgc-instruments.com>
Date: Sat, 7 Oct 2017 23:19:13 +0200
Subject: [PATCH 8/9] Added check for overflows in calculation of size
(cherry picked from commit c2c9fab580f8d6ea237718ad63921cde1d8980f7)
---
src/tiffvisitor.cpp | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/tiffvisitor.cpp b/src/tiffvisitor.cpp
index 2917c9bb..6e5d1754 100644
--- a/src/tiffvisitor.cpp
+++ b/src/tiffvisitor.cpp
@@ -1492,6 +1492,9 @@ namespace Exiv2 {
return;
}
p += 4;
+ if (count > std::numeric_limits<uint32_t>::max() / typeSize) {
+ throw Error(59);
+ }
uint32_t size = typeSize * count;
int32_t offset = getLong(p, byteOrder());
byte* pData = p;
--
2.14.1