Merge pull request #79 from D4N/fix_76

Fixed wrong brackets: size*count + pad can overflow before the cast
v0.27.3
Robin Mills 8 years ago committed by GitHub
commit 272fc46502

@ -227,7 +227,7 @@ namespace Exiv2
: 1; : 1;
// #55 memory allocation crash test/data/POC8 // #55 memory allocation crash test/data/POC8
long long allocate = (long long) (size*count + pad); long long allocate = (long long) size*count + pad;
if ( allocate > (long long) io.size() ) { if ( allocate > (long long) io.size() ) {
throw Error(57); throw Error(57);
} }

@ -402,7 +402,7 @@ namespace Exiv2 {
// if ( offset > io.size() ) offset = 0; // Denial of service? // if ( offset > io.size() ) offset = 0; // Denial of service?
// #55 memory allocation crash test/data/POC8 // #55 memory allocation crash test/data/POC8
long long allocate = (long long) (size*count + pad+20); long long allocate = (long long) size*count + pad+20;
if ( allocate > (long long) io.size() ) { if ( allocate > (long long) io.size() ) {
throw Error(57); throw Error(57);
} }

Loading…
Cancel
Save