18 lines
654 B
Diff
18 lines
654 B
Diff
|
--- dcraw/dcraw.c 2022-04-12 14:29:23.791896447 +0200
|
||
|
|
+++ dcraw/dcraw.c 2022-04-12 14:59:50.767180929 +0200
|
||
|
|
@@ -3289,7 +3289,13 @@
|
||
|
|
}
|
||
|
|
} else if (type == 4) {
|
||
|
|
free (meta_data);
|
||
|
|
- meta_data = (char *) malloc (meta_length = wide*high*3/2);
|
||
|
|
+ meta_data = NULL;
|
||
|
|
+ meta_length = wide*high*3/2;
|
||
|
|
+ if (meta_length/wide != high*3/2) {
|
||
|
|
+ fprintf(stderr, "Potential buffer overflow (meta_length %u, wide %u, high %u). Bailing out...\n", meta_length, wide, high);
|
||
|
|
+ longjmp(failure, 2);
|
||
|
|
+ }
|
||
|
|
+ meta_data = (char *) malloc (meta_length);
|
||
|
|
merror (meta_data, "foveon_load_camf()");
|
||
|
|
foveon_huff (huff);
|
||
|
|
get4();
|