summaryrefslogtreecommitdiff
path: root/XMPFiles/source/FormatSupport/TIFF_Support.hpp
diff options
context:
space:
mode:
Diffstat (limited to 'XMPFiles/source/FormatSupport/TIFF_Support.hpp')
-rw-r--r--XMPFiles/source/FormatSupport/TIFF_Support.hpp8
1 files changed, 7 insertions, 1 deletions
diff --git a/XMPFiles/source/FormatSupport/TIFF_Support.hpp b/XMPFiles/source/FormatSupport/TIFF_Support.hpp
index d4e2f4d..e3e458b 100644
--- a/XMPFiles/source/FormatSupport/TIFF_Support.hpp
+++ b/XMPFiles/source/FormatSupport/TIFF_Support.hpp
@@ -786,7 +786,13 @@ private:
{ if ( GetUns32AsIs(&tifdEntry->bytes) <= 4 ) {
return &tifdEntry->dataOrPos;
} else {
- return (this->tiffStream + GetUns32AsIs(&tifdEntry->dataOrPos));
+ XMP_Uns32 pos = GetUns32AsIs(&tifdEntry->dataOrPos);
+ if (pos + GetUns32AsIs (&tifdEntry->bytes) > this->tiffLength) {
+ // Invalid file.
+ // The data is past the length of the TIFF.
+ return NULL;
+ }
+ return (this->tiffStream + pos);
}
}