image.diff - Exiv2

Bug #1268 » image.diff

diff for src/image.cpp workaround for heap crash. - Ben Touchette, 28 Dec 2016 19:45

+                                    ;
                     // if ( offset > io.size() ) offset = 0; // Denial of service?
                     DataBuf  buf(size*count + pad);  // allocate a buffer
                    int buffer_size = size*count + pad;
                    if (buffer_size < 4) buffer_size = 4;
                     DataBuf  buf(buffer_size);  // allocate a buffer
                     std::memcpy(buf.pData_,dir.pData_+8,4);  // copy dir[8:11] into buffer (short strings)
                     if ( count*size > 4 ) {            // read into buffer
                    if (count*size > 4) {            // read into buffer
                         size_t   restore = io.tell();  // save
                         io.seek(offset,BasicIo::beg);  // position
                         io.read(buf.pData_,count*size);// read

(3-3/3)