diff options
| author | Matthias Clasen <mclasen@redhat.com> | 2005-08-18 14:18:02 +0000 |
|---|---|---|
| committer | Matthias Clasen <matthiasc@src.gnome.org> | 2005-08-18 14:18:02 +0000 |
| commit | a02ffa476a56b7936da3903e6da9b75b5e53c7fe (patch) | |
| tree | d334843b4d96bc7e38d0127908069e9de157bc88 /gdk-pixbuf/io-ico.c | |
| parent | 1169d518475b45950b7625b71a72121a13efe074 (diff) | |
| download | gdk-pixbuf-a02ffa476a56b7936da3903e6da9b75b5e53c7fe.tar.gz | |
Check for overflow in one more place. (#313818, Tommi Komulainen)
2005-08-18 Matthias Clasen <mclasen@redhat.com>
* io-ico.c (DecodeHeader): Check for overflow in one more
place. (#313818, Tommi Komulainen)
Diffstat (limited to 'gdk-pixbuf/io-ico.c')
| -rw-r--r-- | gdk-pixbuf/io-ico.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c index 21f34b2a1..812683daa 100644 --- a/gdk-pixbuf/io-ico.c +++ b/gdk-pixbuf/io-ico.c @@ -261,7 +261,15 @@ static void DecodeHeader(guchar *Data, gint Bytes, so we know how many bytes are in the "header" part. */ State->HeaderSize = State->DIBoffset + 40; /* 40 = sizeof(InfoHeader) */ - + + if (State->HeaderSize < 0) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("Invalid header in icon")); + return; + } + if (State->HeaderSize>State->BytesInHeaderBuf) { guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize); if (!tmp) { |