From 53738879bd6bc400d27b96cf0fe759dadc9f4fb0 Mon Sep 17 00:00:00 2001 From: sun_hai_10 Date: Wed, 14 Jun 2023 16:00:24 +0800 Subject: [PATCH] fix call get_unaligned_be32 heap buffer overflow --- src/cairo-image-info.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/cairo-image-info.c b/src/cairo-image-info.c index d147e37..0310c4b 100644 --- a/src/cairo-image-info.c +++ b/src/cairo-image-info.c @@ -190,7 +190,7 @@ _jpx_match_box (const unsigned char *p, const unsigned char *end, uint32_t type) static const unsigned char * _jpx_find_box (const unsigned char *p, const unsigned char *end, uint32_t type) { - while (p < end) { + while ((p < end) && (p + 4 < end)) { if (_jpx_match_box (p, end, type)) return p; p = _jpx_next_box (p); @@ -346,6 +346,9 @@ _jbig2_get_next_segment (const unsigned char *p, big_page_size = (p[4] & 0x40) != 0; p += 5; + if (p + 4 >= end) + return NULL; + num_segs = p[0] >> 5; if (num_segs == 7) { num_segs = get_unaligned_be32 (p) & 0x1fffffff; -- 2.23.0