diff options
| author | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-03-10 04:29:11 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-03-10 04:29:11 +0000 |
| commit | c6cb5d2707f0a7ca944127e9d38bb916d092f4de (patch) | |
| tree | 9bc11aafa0ee08953fa93853f2a6127caa568010 | |
| parent | 1c6217859ed2ad0b27df4b73c1dcdcda5aebe3d5 (diff) | |
| parent | b75d05a47661cedb2de9bc33da5c8cf349f0f2c6 (diff) | |
| download | libexif-c6cb5d2707f0a7ca944127e9d38bb916d092f4de.tar.gz | |
libexif: Fix read buffer overflow am: 127f882f67 am: 1dac231ca4 am: 9473852786 am: 8b5ffc8c7d am: af6a9d8b7b am: c7c0fec5e2 am: b75d05a476
Change-Id: Id6dbf0d0bdf9a4190bcf04ce2d38f67b8ce9c398
| -rw-r--r-- | libexif/exif-data.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libexif/exif-data.c b/libexif/exif-data.c index eb5d49c..e715d00 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -299,7 +299,9 @@ exif_data_save_data_entry (ExifData *data, ExifEntry *e, /* Write the data. Fill unneeded bytes with 0. Do not crash with * e->data is NULL */ if (e->data) { - memcpy (*d + 6 + doff, e->data, s); + unsigned int len = s; + if (e->size < s) len = e->size; + memcpy (*d + 6 + doff, e->data, len); } else { memset (*d + 6 + doff, 0, s); } |