From fe70939f54476e99046245ca69ff27012401f759 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= Date: Mon, 11 Jun 2018 18:37:36 +0200 Subject: [PATCH] Fix addition overflows in range checks in LoaderTiff::getData Several checks for extracted values performed no overflow checks on the addition. They can be tricked into passing, albeit the individual summands are too large. => use Safe::add() which now aborts when an overflow occurs This fixes #366 --- src/preview.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/preview.cpp b/src/preview.cpp index b5ffc78f9a..b197b19331 100644 --- a/src/preview.cpp +++ b/src/preview.cpp @@ -801,7 +801,7 @@ namespace { // this saves one copying of the buffer uint32_t offset = dataValue.toLong(0); uint32_t size = sizes.toLong(0); - if (offset + size <= static_cast(io.size())) + if (Safe::add(offset, size) <= static_cast(io.size())) dataValue.setDataArea(base + offset, size); } else { @@ -811,8 +811,8 @@ namespace { for (int i = 0; i < sizes.count(); i++) { uint32_t offset = dataValue.toLong(i); uint32_t size = sizes.toLong(i); - enforce(idxBuf + size < size_, kerCorruptedMetadata); - if (size!=0 && offset + size <= static_cast(io.size())) + enforce(Safe::add(idxBuf, size) < size_, kerCorruptedMetadata); + if (size!=0 && Safe::add(offset, size) <= static_cast(io.size())) memcpy(&buf.pData_[idxBuf], base + offset, size); idxBuf += size; }