diff options
Diffstat (limited to 'ext/exif/exif.c')
| -rw-r--r-- | ext/exif/exif.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index b30bcb468f..cbde3effed 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2536,7 +2536,10 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz return; } /* Check to make sure we are not going to go past the ExifLength */ - if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) { + if (ImageInfo->Thumbnail.size > length + || (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length + || ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size + ) { EXIF_ERRLOG_THUMBEOF(ImageInfo) return; } @@ -2715,6 +2718,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu int NumDirEntries, old_motorola_intel, offset_diff; const maker_note_type *maker_note; char *dir_start; + int data_len; for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) { if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) { @@ -2769,6 +2773,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu switch (maker_note->offset_mode) { case MN_OFFSET_MAKER: offset_base = value_ptr; + data_len = value_len; break; case MN_OFFSET_GUESS: if (maker_note->offset + 10 + 4 >= value_len) { @@ -2785,6 +2790,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu return FALSE; } offset_base = value_ptr + offset_diff; + data_len = value_len - offset_diff; break; default: case MN_OFFSET_NORMAL: @@ -2798,7 +2804,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu for (de=0;de<NumDirEntries;de++) { if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de, - offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table)) { + offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) { return FALSE; } } |