Blob Blame History Raw
From 13e5a3e02339b746abcaee6408893ca2fd8e289d Mon Sep 17 00:00:00 2001
From: Pydera <pydera@mailbox.org>
Date: Thu, 8 Apr 2021 17:36:16 +0200
Subject: [PATCH] Fix out of buffer access in #1529

---
 src/jp2image.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index c3fc1eb..09218b1 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -191,9 +191,10 @@ namespace Exiv2
 #endif
                 return;
             }
-            if (box.boxLength == 1)
+            if (box.boxLength < 8)
             {
-                // FIXME. Special case. the real box size is given in another place.
+                // box is broken, so there is nothing we can do here
+                throw Error(14);
             }

             switch(box.boxType)