diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2020-01-04 17:59:28 +0100 |
|---|---|---|
| committer | Marcus Meissner <marcus@jet.franken.de> | 2020-01-04 17:59:28 +0100 |
| commit | 41531c022af8358e88f435ab21aefe792a743d64 (patch) | |
| tree | d264ceca99905796dc73480553eab6e60c98d081 | |
| parent | 6dba732a6a78c86376a75c72e77a06bf1d9a3027 (diff) | |
| download | libgphoto2-41531c022af8358e88f435ab21aefe792a743d64.tar.gz | |
check size of compressed image, (half height of original) (AFL)
| -rw-r--r-- | camlibs/jl2005a/library.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/camlibs/jl2005a/library.c b/camlibs/jl2005a/library.c index 243870636..6ce92ab6f 100644 --- a/camlibs/jl2005a/library.c +++ b/camlibs/jl2005a/library.c @@ -239,9 +239,14 @@ get_file_func (CameraFilesystem *fs, const char *folder, const char *filename, status = GP_ERROR_NO_MEMORY; goto end; } - if (compressed) + if (compressed) { + /* compressed seems to mean half the lines */ + if (w/2*h > b+14) { + status = GP_ERROR_CORRUPTED_DATA; + goto end; + } jl2005a_decompress (image_start, p_data, w, h); - else { + } else { if (w*h > b+14) { status = GP_ERROR_CORRUPTED_DATA; goto end; |