From 6ede8aa1975177705450abb816163f0b8d33a597 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dan.cermak@cgc-instruments.com>

Date: Fri, 6 Oct 2017 23:09:08 +0200

Subject: Fix for CVE-2017-14860

A heap buffer overflow could occur in memcpy when icc.size_ is larger

than data.size_ - pad, as then memcpy would read out of bounds of data.

This commit adds a sanity check to iccLength (= icc.size_): if it is

larger than data.size_ - pad (i.e. an overflow would be caused) an

exception is thrown.

This fixes #71.

diff --git a/src/jp2image.cpp b/src/jp2image.cpp

index 1892fd43..09d023e2 100644

--- a/src/jp2image.cpp

+++ b/src/jp2image.cpp

@@ -269,10 +269,15 @@ namespace Exiv2

                             std::cout << "Exiv2::Jp2Image::readMetadata: "

                                      << "Color data found" << std::endl;

 #endif

-                            long pad = 3 ; // 3 padding bytes 2 0 0

+                            const long pad = 3 ; // 3 padding bytes 2 0 0

                             DataBuf data(subBox.length+8);

                             io_->read(data.pData_,data.size_);

-                            long    iccLength = getULong(data.pData_+pad, bigEndian);

+                            const long    iccLength = getULong(data.pData_+pad, bigEndian);

+                            // subtracting pad from data.size_ is safe:

+                            // size_ is at least 8 and pad = 3

+                            if (iccLength > data.size_ - pad) {

+                                throw Error(58);

+			    }

                             DataBuf icc(iccLength);

                             ::memcpy(icc.pData_,data.pData_+pad,icc.size_);

 #ifdef DEBUG