|
 |
fac8f1 |
diff --git a/include/exiv2/value.hpp b/include/exiv2/value.hpp
|
|
|
fac8f1 |
index 64a8ca7..4e9f285 100644
|
|
|
fac8f1 |
--- a/include/exiv2/value.hpp
|
|
|
fac8f1 |
+++ b/include/exiv2/value.hpp
|
|
|
fac8f1 |
@@ -1658,11 +1658,13 @@ namespace Exiv2 {
|
|
|
fac8f1 |
ok_ = true;
|
|
|
fac8f1 |
return static_cast<long>(value_[n]);
|
|
|
fac8f1 |
}
|
|
|
fac8f1 |
+// #55 crash when value_[n].first == LONG_MIN
|
|
|
fac8f1 |
+#define LARGE_INT 1000000
|
|
|
fac8f1 |
// Specialization for rational
|
|
|
fac8f1 |
template<>
|
|
|
fac8f1 |
inline long ValueType<Rational>::toLong(long n) const
|
|
|
fac8f1 |
{
|
|
|
fac8f1 |
- ok_ = (value_[n].second != 0);
|
|
|
fac8f1 |
+ ok_ = (value_[n].second != 0 && -LARGE_INT < value_[n].first && value_[n].first < LARGE_INT);
|
|
|
fac8f1 |
if (!ok_) return 0;
|
|
|
fac8f1 |
return value_[n].first / value_[n].second;
|
|
|
fac8f1 |
}
|
|
|
fac8f1 |
@@ -1670,7 +1672,7 @@ namespace Exiv2 {
|
|
|
fac8f1 |
template<>
|
|
|
fac8f1 |
inline long ValueType<URational>::toLong(long n) const
|
|
|
fac8f1 |
{
|
|
|
fac8f1 |
- ok_ = (value_[n].second != 0);
|
|
|
fac8f1 |
+ ok_ = (value_[n].second != 0 && value_[n].first < LARGE_INT);
|
|
|
fac8f1 |
if (!ok_) return 0;
|
|
|
fac8f1 |
return value_[n].first / value_[n].second;
|
|
|
fac8f1 |
}
|
|
|
fac8f1 |
diff --git a/src/basicio.cpp b/src/basicio.cpp
|
|
|
fac8f1 |
index 1ede931..eac756f 100644
|
|
|
fac8f1 |
--- a/src/basicio.cpp
|
|
|
fac8f1 |
+++ b/src/basicio.cpp
|
|
|
fac8f1 |
@@ -990,6 +990,7 @@ namespace Exiv2 {
|
|
|
fac8f1 |
DataBuf FileIo::read(long rcount)
|
|
|
fac8f1 |
{
|
|
|
fac8f1 |
assert(p_->fp_ != 0);
|
|
|
fac8f1 |
+ if ( (size_t) rcount > size() ) throw Error(57);
|
|
|
fac8f1 |
DataBuf buf(rcount);
|
|
|
fac8f1 |
long readCount = read(buf.pData_, buf.size_);
|
|
|
fac8f1 |
buf.size_ = readCount;
|
|
|
fac8f1 |
diff --git a/src/image.cpp b/src/image.cpp
|
|
|
fac8f1 |
index 31b9b81..eeb1f37 100644
|
|
|
fac8f1 |
--- a/src/image.cpp
|
|
|
fac8f1 |
+++ b/src/image.cpp
|
|
|
fac8f1 |
@@ -399,7 +399,13 @@ namespace Exiv2 {
|
|
|
fac8f1 |
;
|
|
|
fac8f1 |
|
|
|
fac8f1 |
// if ( offset > io.size() ) offset = 0; // Denial of service?
|
|
|
fac8f1 |
- DataBuf buf(size*count + pad+20); // allocate a buffer
|
|
|
fac8f1 |
+
|
|
|
fac8f1 |
+ // #55 memory allocation crash test/data/POC8
|
|
|
fac8f1 |
+ long long allocate = (long long) size*count + pad+20;
|
|
|
fac8f1 |
+ if ( allocate > (long long) io.size() ) {
|
|
|
fac8f1 |
+ throw Error(57);
|
|
|
fac8f1 |
+ }
|
|
|
fac8f1 |
+ DataBuf buf(allocate); // allocate a buffer
|
|
|
fac8f1 |
std::memcpy(buf.pData_,dir.pData_+8,4); // copy dir[8:11] into buffer (short strings)
|
|
|
fac8f1 |
if ( count*size > 4 ) { // read into buffer
|
|
|
fac8f1 |
size_t restore = io.tell(); // save
|