exiv2/CVE-2022-3756.patch
peng2285 58ff5d87bb CVE-2022-3756
new file:   CVE-2022-3756.patch
2022-11-10 15:06:20 +08:00

31 lines
929 B
Diff

From be374cc6cd51906eaacc7a4f77c9ac37ea7c69c7 Mon Sep 17 00:00:00 2001
From: qz_cx <wangqingzheng@kylinos.cn>
Date: Mon, 31 Oct 2022 14:29:31 +0800
Subject: [PATCH] Avoid potential integer overflow.
Merge pull request #2347 from kevinbackhouse/quicktimevideo-size-calc
Avoid potential integer overflow in QuickTimeVideo::userDataDecoder
@kevinbackhouse
kevinbackhouse committed on 7 Sep
---
src/quicktimevideo.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/quicktimevideo.cpp b/src/quicktimevideo.cpp
index 335d884..9b80947 100644
--- a/src/quicktimevideo.cpp
+++ b/src/quicktimevideo.cpp
@@ -895,7 +895,7 @@ namespace Exiv2 {
tv = find(userDataReferencetags, Exiv2::toString( buf.pData_));
- if(size == 0 || (size - 12) <= 0)
+ if (size <= 12)
break;
else if(equalsQTimeTag(buf, "DcMD") || equalsQTimeTag(buf, "NCDT"))
--
2.33.0