diff options
author | Marcus Meissner <marcus@jet.franken.de> | 2019-12-29 18:22:56 +0100 |
---|---|---|
committer | Marcus Meissner <marcus@jet.franken.de> | 2019-12-29 18:22:56 +0100 |
commit | 6858bab274b9b7f33c22f004ebcea5d0892682ff (patch) | |
tree | 207f0d29e6af55c221d912713a0b372235d53e3b /camlibs/polaroid | |
parent | 3ea99360826c8f79ba6fcac21bdddeb4768d3bfc (diff) | |
download | libgphoto2-6858bab274b9b7f33c22f004ebcea5d0892682ff.tar.gz |
pdc640: width must be at least 2 to avoid a buffer overwrite (AFL)
Diffstat (limited to 'camlibs/polaroid')
-rw-r--r-- | camlibs/polaroid/pdc640.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/camlibs/polaroid/pdc640.c b/camlibs/polaroid/pdc640.c index 2476494f3..543889b15 100644 --- a/camlibs/polaroid/pdc640.c +++ b/camlibs/polaroid/pdc640.c @@ -568,6 +568,7 @@ pdc640_deltadecode (int width, int height, unsigned char **rawdata, int *rawsize GP_DEBUG ("pdc640_deltacode ()"); + if (width < 2) return GP_ERROR_CORRUPTED_DATA; /* invalid, we implicitly assume it to be 2 or higher in the decoder */ /* Create a buffer to store RGB data in */ size = width * height; data = malloc (size * sizeof (char)); |