Better bounds checking in Jp2Image::printStructure

(cherry picked from commit 0fcdde8)
Exiv2 · Jul 5, 2021 · ff00771 · ff00771
1 parent e486a73
commit ff00771
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
@@ -537,6 +537,7 @@ static void boxes_check(size_t b,size_t m)
 
                             if (subBox.type == kJp2BoxTypeColorHeader) {
                                 long pad = 3;  // don't know why there are 3 padding bytes
+                                enforce(data.size_ >= pad, kerCorruptedMetadata);
                                 if (bPrint) {
                                     out << " | pad:";
                                     for (int i = 0; i < 3; i++)
@@ -546,6 +547,7 @@ static void boxes_check(size_t b,size_t m)
                                 if (bPrint) {
                                     out << " | iccLength:" << iccLength;
                                 }
+                                enforce(iccLength <= data.size_ - pad, kerCorruptedMetadata);
                                 if (bICC) {
                                     out.write(reinterpret_cast<const char*>(data.pData_) + pad, iccLength);
                                 }