Package: exiv2 / 0.25-3.1+deb9u1

CVE-2018-11531_3_of_3.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
From 67a5a741153c876a6f1c189abb874721d1725c48 Mon Sep 17 00:00:00 2001
From: Luis Diaz Mas <piponazo@gmail.com>
Date: Fri, 25 May 2018 22:20:03 +0200
Subject: [PATCH] Throw when trying to write out of the buffer

(cherry picked from commit 67a5a741153c876a6f1c189abb874721d1725c48)
[rcs: Backported to stretch]
---
 src/preview.cpp | 2 ++
 1 file changed, 2 insertions(+)

--- exiv2-stretch.git.orig/src/preview.cpp
+++ exiv2-stretch.git/src/preview.cpp
@@ -810,6 +810,8 @@
                     for (int i = 0; i < sizes.count(); i++) {
                         uint32_t offset = dataValue.toLong(i);
                         uint32_t size = sizes.toLong(i);
+                        if (idxBuf + size >= size_)
+                            throw Error(58);
                         if (size!=0 && offset + size <= static_cast<uint32_t>(io.size()))
                             memcpy(&buf.pData_[idxBuf], base + offset, size);
                         idxBuf += size;