changeset 8967:db7f4c441246

PR3207, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read()
author andrew
date Wed, 26 Oct 2016 03:51:39 +0100
parents e97831e64ad3
children 0819886b3679
files src/share/native/sun/java2d/cmm/lcms/cmstypes.c
diffstat 1 files changed, 1 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/native/sun/java2d/cmm/lcms/cmstypes.c	Thu Oct 27 03:05:41 2016 +0100
+++ b/src/share/native/sun/java2d/cmm/lcms/cmstypes.c	Wed Oct 26 03:51:39 2016 +0100
@@ -1484,6 +1484,7 @@
 
         // Check for overflow
         if (Offset < (SizeOfHeader + 8)) goto Error;
+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
 
         // True begin of the string
         BeginOfThisString = Offset - SizeOfHeader - 8;