do not allow string lengths larger than the remaining data within the…

… string vector Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>
kdt3rd · Sep 26, 2024 · f18a951 · f18a951
1 parent cf08f88
commit f18a951
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/lib/OpenEXRCore/parse_header.c b/src/lib/OpenEXRCore/parse_header.c
@@ -607,7 +607,8 @@ extract_attr_string_vector (
 
         pulled += sizeof (int32_t);
         nlen = (int32_t) one_to_native32 ((uint32_t) nlen);
-        if (nlen < 0 || (ctxt->file_size > 0 && nlen > ctxt->file_size))
+        if (nlen < 0 || nlen > (attrsz - pulled) ||
+            (ctxt->file_size > 0 && nlen > ctxt->file_size))
         {
             rv = ctxt->print_error (
                 ctxt,