diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2019-12-29 17:48:56 +0100 |
|---|---|---|
| committer | Marcus Meissner <marcus@jet.franken.de> | 2019-12-29 17:49:22 +0100 |
| commit | 3ea99360826c8f79ba6fcac21bdddeb4768d3bfc (patch) | |
| tree | 1c57a40e8663b6bf5007321ad371823d241b424f | |
| parent | 242e056a6ec02aec1c81147c4210c2ac821a8521 (diff) | |
| download | libgphoto2-3ea99360826c8f79ba6fcac21bdddeb4768d3bfc.tar.gz | |
spca50x: fixed a buffer overflow (AFL)
| -rw-r--r-- | camlibs/spca50x/spca50x-flash.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/camlibs/spca50x/spca50x-flash.c b/camlibs/spca50x/spca50x-flash.c index 86ed02b77..fecf80a3c 100644 --- a/camlibs/spca50x/spca50x-flash.c +++ b/camlibs/spca50x/spca50x-flash.c @@ -580,7 +580,7 @@ spca50x_process_thumbnail (CameraPrivateLibrary *lib, /* context */ yuv_p = buf; rgb_p = tmp + hdrlen; - while (yuv_p < buf + file_size) { + while ((yuv_p < buf + file_size) && (rgb_p < tmp + hdrlen + w*h*3)) { uint32_t u, v, y, y2; uint32_t r, g, b; |