|
|
|
@ -401,7 +401,7 @@ namespace Exiv2 {
|
|
|
|
|
|
|
|
|
|
// if ( offset > io.size() ) offset = 0; // Denial of service?
|
|
|
|
|
|
|
|
|
|
// #55 memory allocation crash test/data/POC8
|
|
|
|
|
// #55 and #56 memory allocation crash test/data/POC8
|
|
|
|
|
long long allocate = (long long) size*count + pad+20;
|
|
|
|
|
if ( allocate > (long long) io.size() ) {
|
|
|
|
|
throw Error(57);
|
|
|
|
|