diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2020-06-06 10:10:43 +0200 |
|---|---|---|
| committer | Marcus Meissner <marcus@jet.franken.de> | 2020-06-06 10:10:43 +0200 |
| commit | 174943496afea3dd367f3d7a3eef667d3392ec48 (patch) | |
| tree | f56fea90aa45a168d2a4f786ddb17c86162f547d /camlibs/soundvision | |
| parent | a6573a276d2d9c0e87d142667c4581d9bd359853 (diff) | |
| download | libgphoto2-174943496afea3dd367f3d7a3eef667d3392ec48.tar.gz | |
limit taken pictures to avoid integer overfglows (AFL)
Diffstat (limited to 'camlibs/soundvision')
| -rw-r--r-- | camlibs/soundvision/agfa_cl18.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/camlibs/soundvision/agfa_cl18.c b/camlibs/soundvision/agfa_cl18.c index d8cfdb9e1..5c1d5c623 100644 --- a/camlibs/soundvision/agfa_cl18.c +++ b/camlibs/soundvision/agfa_cl18.c @@ -133,6 +133,9 @@ int agfa_delete_picture(CameraPrivateLibrary *dev, const char *filename) { taken=soundvision_photos_taken(dev); taken=soundvision_photos_taken(dev); taken=soundvision_photos_taken(dev); + + if (taken > ((1<<31) / 13 )) + return GP_ERROR_NO_MEMORY; buflen = (taken * 13)+1; /* 12 char filenames and space for each */ /* plus trailing NULL */ |