potok/TinyEXIF
1
0
Fork 0
mirror of https://github.com/cdcseacave/TinyEXIF.git synced 2026-07-21 19:23:01 +04:00
Code Packages Releases Wiki Activity

Fix possible integer overflow in parseString bounds check (#26)

Browse Source 
* Fix integer overflow in parseString bounds check

Cast `base` to `uint64_t` in the parseString bounds check
`base+data+num_components <= len` to prevent unsigned integer overflow.

When `data` is attacker-controlled (e.g. 0xffffffff), the 32-bit
unsigned addition wraps around, causing the check to pass even though
the computed offset is far beyond the buffer. This leads to an
out-of-bounds heap read or segfault when dereferencing the resulting
pointer.

Fixes #16

* Fix type casting for base pointer comparison
This commit is contained in:
cDc
2026-03-19 06:55:25 +02:00
committed by GitHub
parent 841e292929
commit b6ea1b7bbe
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TinyEXIF.cpp
+1 -1
View File
@@ -301,7 +301,7 @@ public:
if (value[num_components-1] == '\0') if (value[num_components-1] == '\0')
value.resize(num_components-1); value.resize(num_components-1);
} else } else
if (base+data+num_components <= len) { if ((uint64_t)base+data+num_components <= (uint64_t)len) {
const char* const sz((const char*)buf+base+data); const char* const sz((const char*)buf+base+data);
unsigned num(0); unsigned num(0);
while (num < num_components && sz[num] != '\0') while (num < num_components && sz[num] != '\0')