diff options
| author | Gaurav <g.gupta@samsung.com> | 2019-09-24 14:28:19 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-09-24 14:28:19 +0530 |
| commit | d1fcbdc6bcdd50432ae95e9c6f83e79338f87690 (patch) | |
| tree | 4aa479e780dfdf982c90022b09e0a7f784730d68 | |
| parent | 7e1a1643df34dae1b756f6ae6ed71f9c8d8af667 (diff) | |
| download | lcms2-d1fcbdc6bcdd50432ae95e9c6f83e79338f87690.tar.gz | |
Buffer overflow fix.
BuildColorantList() concatenates 32 bit data in each iteration. The max value of iteration can be 16.
Thus buffer overflow can occur with storage of 128 bytes. It would need 512 bytes in worst case.
| -rw-r--r-- | src/cmsps2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/cmsps2.c b/src/cmsps2.c index deab55d..ff445b6 100644 --- a/src/cmsps2.c +++ b/src/cmsps2.c @@ -1414,7 +1414,7 @@ int WriteNamedColorCRD(cmsIOHANDLER* m, cmsHPROFILE hNamedColor, cmsUInt32Number cmsUInt32Number i, nColors, nColorant; cmsUInt32Number OutputFormat; char ColorName[cmsMAX_PATH]; - char Colorant[128]; + char Colorant[512]; cmsNAMEDCOLORLIST* NamedColorList; |