30 lines
1.2 KiB
Diff
30 lines
1.2 KiB
Diff
|
From e38454aa1a15b78c028a778fc8bfba3587e25c25 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Michael Vetter <jubalh@iodoru.org>
|
||
|
|
Date: Fri, 15 Mar 2019 11:01:02 +0100
|
||
|
|
Subject: [PATCH] Make sure asclen is at least 1
|
||
|
|
|
||
|
|
If txtdesc->asclen is < 1, the array index of txtdesc->ascdata will be negative which causes the heap based overflow.
|
||
|
|
|
||
|
|
Regards CVE-2018-19540.
|
||
|
|
Regards https://github.com/mdadams/jasper/issues/182 bug#3
|
||
|
|
Fix by Markus Koschany <apo@debian.org>.
|
||
|
|
From https://gist.github.com/apoleon/13598a45bf6522f6a79b77a629205823
|
||
|
|
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
|
||
|
|
---
|
||
|
|
src/libjasper/base/jas_icc.c | 2 ++
|
||
|
|
1 file changed, 2 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/src/libjasper/base/jas_icc.c b/src/libjasper/base/jas_icc.c
|
||
|
|
index 4607930..762c0e8 100644
|
||
|
|
--- a/src/libjasper/base/jas_icc.c
|
||
|
|
+++ b/src/libjasper/base/jas_icc.c
|
||
|
|
@@ -1104,6 +1104,8 @@ static int jas_icctxtdesc_input(jas_iccattrval_t *attrval, jas_stream_t *in,
|
||
|
|
if (jas_stream_read(in, txtdesc->ascdata, txtdesc->asclen) !=
|
||
|
|
JAS_CAST(int, txtdesc->asclen))
|
||
|
|
goto error;
|
||
|
|
+ if (txtdesc->asclen < 1)
|
||
|
|
+ goto error;
|
||
|
|
txtdesc->ascdata[txtdesc->asclen - 1] = '\0';
|
||
|
|
if (jas_iccgetuint32(in, &txtdesc->uclangcode) ||
|
||
|
|
jas_iccgetuint32(in, &txtdesc->uclen))
|