diff --git a/src/pngchunk_int.cpp b/src/pngchunk_int.cpp index 57c9f62b..19f5d9b7 100644 --- a/src/pngchunk_int.cpp +++ b/src/pngchunk_int.cpp @@ -103,15 +103,17 @@ namespace Exiv2 { { // From a tEXt, zTXt, or iTXt chunk, // we get the key, it's a null terminated string at the chunk start - if (data.size_ <= (stripHeader ? 8 : 0)) throw Error(14); - const byte *key = data.pData_ + (stripHeader ? 8 : 0); + const int offset = stripHeader ? 8 : 0; + if (data.size_ <= offset) throw Error(14); + const byte *key = data.pData_ + offset; // Find null string at end of key. int keysize=0; - for ( ; key[keysize] != 0 ; keysize++) + while (key[keysize] != 0) { + keysize++; // look if keysize is valid. - if (keysize >= data.size_) + if (keysize+offset >= data.size_) throw Error(14); } diff --git a/test/data/issue_187 b/test/data/issue_187 new file mode 100644 index 00000000..3e05cc9e Binary files /dev/null and b/test/data/issue_187 differ diff --git a/tests/bugfixes/github/test_CVE_2017_17669.py b/tests/bugfixes/github/test_CVE_2017_17669.py new file mode 100644 index 00000000..803bb92a --- /dev/null +++ b/tests/bugfixes/github/test_CVE_2017_17669.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- + +import system_tests + + +class RunPocFile(system_tests.Case): + + filename = "{data_path}/issue_187" + commands = ["{exiv2} " + filename] + retval = [1] + stdout = [""] + stderr = [ + """{exiv2_exception_msg} """ + filename + """: +{error_14_message} +""" + ] diff --git a/tests/suite.conf b/tests/suite.conf index d143f780..134b1471 100644 --- a/tests/suite.conf +++ b/tests/suite.conf @@ -15,6 +15,7 @@ data_path: ../test/data tiff-test: ${ENV:exiv2_path}/tiff-test${ENV:binary_extension} [variables] +error_14_message: Failed to read image data error_58_message: corrupted image metadata error_57_message: invalid memory allocation request exiv2_exception_msg: Exiv2 exception in print action for file