Check for overflow in one more place. (#313818, Tommi Komulainen)

2005-08-18  Matthias Clasen  <mclasen@redhat.com>

	* io-ico.c (DecodeHeader): Check for overflow in one more
	place.  (#313818, Tommi Komulainen)

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index c69f58bd37bac369a92b144440badfc350172d31..37ab659a6235d08d444d3e26c49e03bc2f246375 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,8 @@
+2005-08-18  Matthias Clasen  <mclasen@redhat.com>
+
+       * io-ico.c (DecodeHeader): Check for overflow in one more
+       place.  (#313818, Tommi Komulainen)
+
 2005-08-15  Matthias Clasen  <mclasen@redhat.com>
 
        * io-jpeg.c (fatal_error_handler): Pay attention to the 

diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
index 21f34b2a1bbb89da6a1f67660b48fb71ceefeead..812683daa62ba0cd74c418c4bfcacb43bfe3f852 100644 (file)
--- a/gdk-pixbuf/io-ico.c
+++ b/gdk-pixbuf/io-ico.c
@@ -261,7 +261,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
           so we know how many bytes are in the "header" part. */
              
        State->HeaderSize = State->DIBoffset + 40; /* 40 = sizeof(InfoHeader) */
-       
+
+       if (State->HeaderSize < 0) {
+               g_set_error (error,
+                            GDK_PIXBUF_ERROR,
+                            GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                            _("Invalid header in icon"));
+               return;
+       }
+
        if (State->HeaderSize>State->BytesInHeaderBuf) {
                guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize);
                if (!tmp) {