From 9be257340193dbe3fb810aa33531c40ae9df6414 Mon Sep 17 00:00:00 2001

From: Kevin Backhouse <kevinbackhouse@github.com>

Date: Wed, 30 Jun 2021 16:47:50 +0100

Subject: [PATCH 2/2] Fix incorrect loop condition.

---

 src/jp2image.cpp                                      |  6 ++++--

 .../bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py | 11 +++++------

 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/jp2image.cpp b/src/jp2image.cpp

index 2cd0a89..58ad5c6 100644

--- a/src/jp2image.cpp

+++ b/src/jp2image.cpp

@@ -619,11 +619,13 @@ namespace Exiv2

         char*         p      = (char*) boxBuf.pData_;

         bool          bWroteColor = false ;

-        while ( count < length || !bWroteColor ) {

+        while ( count < length && !bWroteColor ) {

             Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;

             // copy data.  pointer could be into a memory mapped file which we will decode!

-            Jp2BoxHeader   subBox = *pSubBox ;

+            // pSubBox isn't always an aligned pointer, so use memcpy to do the copy.

+            Jp2BoxHeader   subBox;

+            memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader));

             Jp2BoxHeader   newBox =  subBox;

             if ( count < length ) {