From 7d3c1bea895d910907e2501fe9165e353eceabae Mon Sep 17 00:00:00 2001 From: Markus Kuhn Date: Mon, 15 Feb 2021 18:27:47 +0000 Subject: [PATCH 15/15] jbg_newlen(): check for end-of-file within MARKER_NEWLEN fixes https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969593 reported by Casper Sun --- libjbig/jbig.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libjbig/jbig.c b/libjbig/jbig.c index e9938e5..289b6d8 100644 --- a/libjbig/jbig.c +++ b/libjbig/jbig.c @@ -3272,6 +3272,8 @@ int jbg_newlen(unsigned char *bie, size_t len) else if (p[0] == MARKER_ESC) switch (p[1]) { case MARKER_NEWLEN: + if (p + 5 >= bie + len) + return JBG_EAGAIN; y = (((long) bie[ 8] << 24) | ((long) bie[ 9] << 16) | ((long) bie[10] << 8) | (long) bie[11]); yn = (((long) p[2] << 24) | ((long) p[3] << 16) | -- 2.45.0