36 lines
1.1 KiB
Diff
36 lines
1.1 KiB
Diff
|
From 53738879bd6bc400d27b96cf0fe759dadc9f4fb0 Mon Sep 17 00:00:00 2001
|
||
|
|
From: sun_hai_10 <sunhai10@huawei.com>
|
||
|
|
Date: Wed, 14 Jun 2023 16:00:24 +0800
|
||
|
|
Subject: [PATCH] fix call get_unaligned_be32 heap buffer overflow
|
||
|
|
|
||
|
|
---
|
||
|
|
src/cairo-image-info.c | 5 ++++-
|
||
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/src/cairo-image-info.c b/src/cairo-image-info.c
|
||
|
|
index d147e37..0310c4b 100644
|
||
|
|
--- a/src/cairo-image-info.c
|
||
|
|
+++ b/src/cairo-image-info.c
|
||
|
|
@@ -190,7 +190,7 @@ _jpx_match_box (const unsigned char *p, const unsigned char *end, uint32_t type)
|
||
|
|
static const unsigned char *
|
||
|
|
_jpx_find_box (const unsigned char *p, const unsigned char *end, uint32_t type)
|
||
|
|
{
|
||
|
|
- while (p < end) {
|
||
|
|
+ while ((p < end) && (p + 4 < end)) {
|
||
|
|
if (_jpx_match_box (p, end, type))
|
||
|
|
return p;
|
||
|
|
p = _jpx_next_box (p);
|
||
|
|
@@ -346,6 +346,9 @@ _jbig2_get_next_segment (const unsigned char *p,
|
||
|
|
big_page_size = (p[4] & 0x40) != 0;
|
||
|
|
p += 5;
|
||
|
|
|
||
|
|
+ if (p + 4 >= end)
|
||
|
|
+ return NULL;
|
||
|
|
+
|
||
|
|
num_segs = p[0] >> 5;
|
||
|
|
if (num_segs == 7) {
|
||
|
|
num_segs = get_unaligned_be32 (p) & 0x1fffffff;
|
||
|
|
--
|
||
|
|
2.23.0
|
||
|
|
|