Package: exiv2 / 0.25-3.1+deb9u1

CVE-2018-11531_1_of_3.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
From ed874703ad553338f973d537b8159d0eb4375cc4 Mon Sep 17 00:00:00 2001
From: Luis Diaz Mas <piponazo@gmail.com>
Date: Fri, 25 May 2018 22:03:26 +0200
Subject: [PATCH] Prevent call to memcpy with size==0

(cherry picked from commit ed874703ad553338f973d537b8159d0eb4375cc4)
[rcs: Backported to stretch]
---
 src/preview.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- exiv2-stretch.git.orig/src/preview.cpp
+++ exiv2-stretch.git/src/preview.cpp
@@ -810,7 +810,7 @@
                     for (int i = 0; i < sizes.count(); i++) {
                         uint32_t offset = dataValue.toLong(i);
                         uint32_t size = sizes.toLong(i);
-                        if (offset + size <= static_cast<uint32_t>(io.size()))
+                        if (size!=0 && offset + size <= static_cast<uint32_t>(io.size()))
                             memcpy(pos, base + offset, size);
                         pos += size;
                     }