fix reading images with unspecified jpgC box

strukturag · Nov 4, 2023 · c2eedac · c2eedac
1 parent e8c158c
commit c2eedac
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/libheif/jpeg.cc b/libheif/jpeg.cc
@@ -20,6 +20,7 @@
 
 #include "jpeg.h"
 #include <string>
+#include "security_limits.h"
 
 std::string Box_jpgC::dump(Indent& indent) const
 {
@@ -46,7 +47,15 @@ Error Box_jpgC::write(StreamWriter& writer) const
 
 Error Box_jpgC::parse(BitstreamRange& range)
 {
+  if (!has_fixed_box_size()) {
+    return Error{heif_error_Unsupported_feature, heif_suberror_Unspecified, "jpgC with unspecified size are not supported"};
+  }
+
   size_t nBytes = range.get_remaining_bytes();
+  if (nBytes > MAX_MEMORY_BLOCK_SIZE) {
+    return Error{heif_error_Invalid_input, heif_suberror_Unspecified, "jpgC block exceeds maximum size"};
+  }
+
   m_data.resize(nBytes);
   range.read(m_data.data(), nBytes);
   return range.get_error();