From 4d9724f2f67bca4005ca50c22afccd7bf30cc2e8 Mon Sep 17 00:00:00 2001 From: Simon Budig Date: Wed, 9 Dec 2009 16:05:05 +0100 Subject: [PATCH] SGI: fix out of bounds writes The functions read_rle8() and read_rle16() didn't check if the addresses to which they wrote are in bounds when expanding runlength encoded data. --- plug-ins/file-sgi/sgi-lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plug-ins/file-sgi/sgi-lib.c b/plug-ins/file-sgi/sgi-lib.c index 7fd61d04b3..c26e24e883 100644 --- a/plug-ins/file-sgi/sgi-lib.c +++ b/plug-ins/file-sgi/sgi-lib.c @@ -680,7 +680,7 @@ read_rle8(sgi_t *sgip, /* I - SGI image to read from */ return (-1); length ++; - count = ch & 127; + count = MIN (ch & 127, xsize); if (count == 0) break; @@ -725,7 +725,7 @@ read_rle16(sgi_t *sgip, /* I - SGI image to read from */ return (-1); length ++; - count = ch & 127; + count = MIN (ch & 127, xsize); if (count == 0) break;