Fixing bin/exiv2 -pR ~/Downloads/bugs/pngimage-heap-bof-poc-1.dms in #…

…590
Exiv2 · Dec 10, 2018 · 4f9c912 · 4f9c912
1 parent af7ca26
commit 4f9c912
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/src/pngimage.cpp b/src/pngimage.cpp
@@ -327,9 +327,16 @@ namespace Exiv2 {
 
                     // decode the chunk
                     bool bGood = false;
-                    if ( tEXt ) {
-                        bGood = tEXtToDataBuf(data+name_l,dataOffset-name_l,dataBuf);
+                    if ( dataOffset > name_l + 2 ) {
+                        if ( tEXt ) {
+                            bGood = tEXtToDataBuf(data + name_l, dataOffset - name_l, dataBuf);
+                        }
+                        if (zTXt || iCCP) {
+                            bGood = zlibToDataBuf(data + name_l + 1, dataOffset - name_l - 1,
+                                                  dataBuf); // +1 = 'compressed' flag
+                        }
                     }
+
                     if ( zTXt || iCCP ) {
                         bGood = zlibToDataBuf(data+name_l+1,dataOffset-name_l-1,dataBuf); // +1 = 'compressed' flag
                     }