diff options
| author | Hubert Figuière <hub@figuiere.net> | 2017-08-14 23:57:51 -0400 |
|---|---|---|
| committer | Hubert Figuière <hub@figuiere.net> | 2017-08-15 00:04:41 -0400 |
| commit | ab0f2968a627c2b7762db4ec8ec91949b3488e4a (patch) | |
| tree | 32110922a66e551574899d04ccf62f6e5359efa1 /XMPFiles | |
| parent | fe2b070c10dce42ffa2ec788a40b4f2c8fb0e78b (diff) | |
2.4.x: Bug 102151 - RIFF: fix an infinite loop cause by an overflow
Diffstat (limited to 'XMPFiles')
| -rw-r--r-- | XMPFiles/source/FormatSupport/RIFF.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/XMPFiles/source/FormatSupport/RIFF.cpp b/XMPFiles/source/FormatSupport/RIFF.cpp index 4bcce6e..88c1260 100644 --- a/XMPFiles/source/FormatSupport/RIFF.cpp +++ b/XMPFiles/source/FormatSupport/RIFF.cpp @@ -173,7 +173,8 @@ Chunk::Chunk( ContainerChunk* parent, RIFF_MetaHandler* handler, bool skip, Chun this->oldPos = file->Offset(); this->id = XIO::ReadUns32_LE( file ); - this->oldSize = XIO::ReadUns32_LE( file ) + 8; + this->oldSize = XIO::ReadUns32_LE( file ); + this->oldSize += 8; // Make sure the size is within expected bounds. XMP_Int64 chunkEnd = this->oldPos + this->oldSize; |