diff options
Diffstat (limited to 'XMPFiles/source/FormatSupport/TIFF_Support.hpp')
-rw-r--r-- | XMPFiles/source/FormatSupport/TIFF_Support.hpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/XMPFiles/source/FormatSupport/TIFF_Support.hpp b/XMPFiles/source/FormatSupport/TIFF_Support.hpp index 3914809..f82bbc2 100644 --- a/XMPFiles/source/FormatSupport/TIFF_Support.hpp +++ b/XMPFiles/source/FormatSupport/TIFF_Support.hpp @@ -790,7 +790,13 @@ private: { if ( GetUns32AsIs(&tifdEntry->bytes) <= 4 ) { return &tifdEntry->dataOrPos; } else { - return (this->tiffStream + GetUns32AsIs(&tifdEntry->dataOrPos)); + XMP_Uns32 pos = GetUns32AsIs(&tifdEntry->dataOrPos); + if (pos + GetUns32AsIs (&tifdEntry->bytes) > this->tiffLength) { + // Invalid file. + // The data is past the length of the TIFF. + return NULL; + } + return (this->tiffStream + pos); } } |