commit e47b2d1d36c4b9af044ad9fff17efe5b1069bfac parent 4c2b88c7c64600b1c17a31af7e0f60039c65496b Author: Christian Grothoff <christian@grothoff.org> Date: Wed, 29 Jul 2026 11:09:51 +0200 fix off-by-one bounds check Diffstat:
| M | src/plugins/png_extractor.c | | | 9 | +++++++-- |
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/plugins/png_extractor.c b/src/plugins/png_extractor.c @@ -234,11 +234,16 @@ processiTXt (struct EXTRACTOR_ExtractContext *ec, if (pos >= length) return 0; compressed = data[pos++]; - if (pos > length) + /* `pos > length' can never hold here -- the check above left pos at + most length - 1 and it was incremented once -- so it let pos == + length through and the read below went one byte past the buffer + ec->read() handed us. Only `length' bytes are ours; at a window + boundary the next byte is not even mapped. */ + if (pos >= length) return 0; if (compressed && (0 != data[pos++])) return 0; /* bad compression method */ - if (pos > length) + if (pos >= length) return 0; language = (char *) &data[pos]; ret = 0;