You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
32 lines
1.3 KiB
32 lines
1.3 KiB
3 years ago
|
diff --git a/src/preview.cpp b/src/preview.cpp
|
||
|
|
index c34c8bd..69f8e01 100644
|
||
|
|
--- a/src/preview.cpp
|
||
|
|
+++ b/src/preview.cpp
|
||
|
|
@@ -36,6 +36,7 @@ EXIV2_RCSID("@(#) $Id$")
|
||
|
|
|
||
|
|
#include "preview.hpp"
|
||
|
|
#include "futils.hpp"
|
||
|
|
+#include "enforce.hpp"
|
||
|
|
|
||
|
|
#include "image.hpp"
|
||
|
|
#include "cr2image.hpp"
|
||
|
|
@@ -807,13 +808,14 @@ namespace {
|
||
|
|
else {
|
||
|
|
// FIXME: the buffer is probably copied twice, it should be optimized
|
||
|
|
DataBuf buf(size_);
|
||
|
|
- Exiv2::byte* pos = buf.pData_;
|
||
|
|
+ uint32_t idxBuf = 0;
|
||
|
|
for (int i = 0; i < sizes.count(); i++) {
|
||
|
|
uint32_t offset = dataValue.toLong(i);
|
||
|
|
uint32_t size = sizes.toLong(i);
|
||
|
|
- if (offset + size <= static_cast<uint32_t>(io.size()))
|
||
|
|
- memcpy(pos, base + offset, size);
|
||
|
|
- pos += size;
|
||
|
|
+ enforce(idxBuf + size < size_, kerCorruptedMetadata);
|
||
|
|
+ if (size!=0 && offset + size <= static_cast<uint32_t>(io.size()))
|
||
|
|
+ memcpy(&buf.pData_[idxBuf], base + offset, size);
|
||
|
|
+ idxBuf += size;
|
||
|
|
}
|
||
|
|
dataValue.setDataArea(buf.pData_, buf.size_);
|
||
|
|
}
|