diff options
| author | Marcus Meissner <meissner@suse.de> | 2020-02-24 16:43:42 +0100 |
|---|---|---|
| committer | Marcus Meissner <meissner@suse.de> | 2020-02-24 16:43:42 +0100 |
| commit | b62b70e9080b0d04f2ba242d7920aa0d786c747e (patch) | |
| tree | 3c1a4ed654a50837db97f884588fbc9af9e6cf50 /camlibs/spca50x | |
| parent | 69f379ff0c5902a2333fa912710c33c31f977f57 (diff) | |
| download | libgphoto2-b62b70e9080b0d04f2ba242d7920aa0d786c747e.tar.gz | |
spca50x: fixed a buffer overflow during yuv2rgb conversion (AFL)
Diffstat (limited to 'camlibs/spca50x')
| -rw-r--r-- | camlibs/spca50x/spca50x-flash.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/camlibs/spca50x/spca50x-flash.c b/camlibs/spca50x/spca50x-flash.c index efb73efd8..f4f1d844b 100644 --- a/camlibs/spca50x/spca50x-flash.c +++ b/camlibs/spca50x/spca50x-flash.c @@ -580,7 +580,7 @@ spca50x_process_thumbnail (CameraPrivateLibrary *lib, /* context */ yuv_p = buf; rgb_p = tmp + hdrlen; - while ((yuv_p < buf + file_size) && (rgb_p < tmp + hdrlen + w*h*3)) { + while ((yuv_p < buf + file_size) && (rgb_p < tmp + hdrlen + w*h*3 - 6)) { uint32_t u, v, y, y2; uint32_t r, g, b; |