You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
61 lines
2.4 KiB
61 lines
2.4 KiB
3 years ago
|
diff --git a/src/preview.cpp b/src/preview.cpp
|
||
|
|
index 69f8e01..d20de04 100644
|
||
|
|
--- a/src/preview.cpp
|
||
|
|
+++ b/src/preview.cpp
|
||
|
|
@@ -37,6 +37,7 @@ EXIV2_RCSID("@(#) $Id$")
|
||
|
|
#include "preview.hpp"
|
||
|
|
#include "futils.hpp"
|
||
|
|
#include "enforce.hpp"
|
||
|
|
+#include "safe_op.hpp"
|
||
|
|
|
||
|
|
#include "image.hpp"
|
||
|
|
#include "cr2image.hpp"
|
||
|
|
@@ -386,7 +387,7 @@ namespace {
|
||
|
|
return AutoPtr();
|
||
|
|
|
||
|
|
if (loaderList_[id].imageMimeType_ &&
|
||
|
|
- std::string(loaderList_[id].imageMimeType_) != std::string(image.mimeType()))
|
||
|
|
+ std::string(loaderList_[id].imageMimeType_) != image.mimeType())
|
||
|
|
return AutoPtr();
|
||
|
|
|
||
|
|
AutoPtr loader = loaderList_[id].create_(id, image, loaderList_[id].parIdx_);
|
||
|
|
@@ -548,7 +549,8 @@ namespace {
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (offset_ + size_ > static_cast<uint32_t>(image_.io().size())) return;
|
||
|
|
+ if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
|
||
|
|
+ return;
|
||
|
|
|
||
|
|
valid_ = true;
|
||
|
|
}
|
||
|
|
@@ -802,7 +804,7 @@ namespace {
|
||
|
|
// this saves one copying of the buffer
|
||
|
|
uint32_t offset = dataValue.toLong(0);
|
||
|
|
uint32_t size = sizes.toLong(0);
|
||
|
|
- if (offset + size <= static_cast<uint32_t>(io.size()))
|
||
|
|
+ if (Safe::add(offset, size) <= static_cast<uint32_t>(io.size()))
|
||
|
|
dataValue.setDataArea(base + offset, size);
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
@@ -812,8 +814,8 @@ namespace {
|
||
|
|
for (int i = 0; i < sizes.count(); i++) {
|
||
|
|
uint32_t offset = dataValue.toLong(i);
|
||
|
|
uint32_t size = sizes.toLong(i);
|
||
|
|
- enforce(idxBuf + size < size_, kerCorruptedMetadata);
|
||
|
|
- if (size!=0 && offset + size <= static_cast<uint32_t>(io.size()))
|
||
|
|
+ enforce(Safe::add(idxBuf, size) < size_, kerCorruptedMetadata);
|
||
|
|
+ if (size!=0 && Safe::add(offset, size) <= static_cast<uint32_t>(io.size()))
|
||
|
|
memcpy(&buf.pData_[idxBuf], base + offset, size);
|
||
|
|
idxBuf += size;
|
||
|
|
}
|
||
|
|
@@ -930,7 +932,7 @@ namespace {
|
||
|
|
|
||
|
|
DataBuf decodeBase64(const std::string& src)
|
||
|
|
{
|
||
|
|
- const unsigned long srcSize = static_cast<const unsigned long>(src.size());
|
||
|
|
+ const unsigned long srcSize = src.size();
|
||
|
|
|
||
|
|
// create decoding table
|
||
|
|
unsigned long invalid = 64;
|