handle size of data in canon file entry decoder (AFL)

1 files changed, 13 insertions, 0 deletions

diff --git a/camlibs/ptp2/ptp.c b/camlibs/ptp2/ptp.c
index 28e64b944..835fee8e7 100644
--- a/camlibs/ptp2/ptp.c
+++ b/camlibs/ptp2/ptp.c
@@ -2405,6 +2405,11 @@ ptp_canon_eos_getobjectinfoex (
 		return PTP_RC_OK;
 	}
 
+	if (size < 4) {
+		ret = PTP_RC_GeneralError;
+		goto exit;
+	}
+
 	*nrofentries = dtoh32a(data);
 	*entries = malloc(*nrofentries * sizeof(PTPCANONFolderEntry));
 	if (!*entries) {
@@ -2414,6 +2419,14 @@ ptp_canon_eos_getobjectinfoex (
 
 	xdata = data+sizeof(uint32_t);
 	for (i=0;i<*nrofentries;i++) {
+		if ((dtoh32a(xdata) + (xdata-data)) > size) {
+			ptp_debug (params, "reading canon FEs run over read data size?\n");
+			free (*entries);
+			*entries = NULL;
+			*nrofentries = 0;
+			ret = PTP_RC_GeneralError;
+			goto exit;
+		}
 		ptp_unpack_Canon_EOS_FE (params, &xdata[4], &((*entries)[i]));
 		xdata += dtoh32a(xdata);
 	}