diff options
Diffstat (limited to 'camlibs/agfa-cl20')
| -rw-r--r-- | camlibs/agfa-cl20/agfa_cl20.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/camlibs/agfa-cl20/agfa_cl20.c b/camlibs/agfa-cl20/agfa_cl20.c index 35ee333d6..c54f6b2c3 100644 --- a/camlibs/agfa-cl20/agfa_cl20.c +++ b/camlibs/agfa-cl20/agfa_cl20.c @@ -208,7 +208,7 @@ get_file_func (CameraFilesystem *fs, const char *folder, const char *filename, lb = (unsigned char)*(result + 0x05); hb = (unsigned char)*(result + 0x04); app1len = (unsigned int)(hb * 256) + (unsigned int)(lb); - if (app1len > size - 3) { + if ((app1len < 4) || (app1len > size - 4)) { free (result); GP_DEBUG("app1len %d is larger than size %d", app1len, size); return GP_ERROR_CORRUPTED_DATA; @@ -234,7 +234,7 @@ get_file_func (CameraFilesystem *fs, const char *folder, const char *filename, memmove(&result[20], &result[app1len + 4], - (unsigned int)(size - app1len - 2)); + (unsigned int)(size - app1len - 4)); size = size - app1len + 24; |