diff options
author | Marti Maria <info@littlecms.com> | 2017-03-20 17:12:15 +0100 |
---|---|---|
committer | Marti Maria <info@littlecms.com> | 2017-03-20 17:12:15 +0100 |
commit | f9d75ccef0b54c9f4167d95088d4727985133c52 (patch) | |
tree | 90726e7f3a2c934a84d731c79147543719139479 /src | |
parent | 76d1dccf3e5ce0c67125964d0908b322e7d1afb9 (diff) | |
download | lcms2-f9d75ccef0b54c9f4167d95088d4727985133c52.tar.gz |
[oss-fuzz] Fix corrupted tag detection on MPE
Diffstat (limited to 'src')
-rw-r--r-- | src/cmsio0.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/cmsio0.c b/src/cmsio0.c index eafd41d..af3249d 100644 --- a/src/cmsio0.c +++ b/src/cmsio0.c @@ -1541,6 +1541,8 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig) Offset = Icc -> TagOffsets[n]; TagSize = Icc -> TagSizes[n]; + if (TagSize < 8) goto Error; + // Seek to its location if (!io -> Seek(io, Offset)) goto Error; @@ -1563,8 +1565,8 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig) if (BaseType == 0) goto Error; if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error; - - TagSize -= 8; // Alredy read by the type base logic + + TagSize -= 8; // Alredy read by the type base logic // Get type handler TypeHandler = _cmsGetTagTypeHandler(Icc ->ContextID, BaseType); |