diff options
| author | Michael Brown | 2020-06-04 23:09:11 +0200 |
|---|---|---|
| committer | Michael Brown | 2020-06-04 23:09:11 +0200 |
| commit | d68befef1ad2cd2c68d631c99157bd9ae4c79bee (patch) | |
| tree | b836c84987b5c59efbfe8beed258f980f6261760 /src/image | |
| parent | [bnxt] Add driver support for Broadcom NetXtreme-E Adapters (diff) | |
| download | ipxe-d68befef1ad2cd2c68d631c99157bd9ae4c79bee.tar.gz ipxe-d68befef1ad2cd2c68d631c99157bd9ae4c79bee.tar.xz ipxe-d68befef1ad2cd2c68d631c99157bd9ae4c79bee.zip | |
[png] Fix potential integer overflow
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/image')
| -rw-r--r-- | src/image/png.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/image/png.c b/src/image/png.c index 5c4bcb3a0..d5cf7fd8f 100644 --- a/src/image/png.c +++ b/src/image/png.c @@ -924,9 +924,9 @@ static int png_pixbuf ( struct image *image, struct pixel_buffer **pixbuf ) { /* Extract chunk header */ remaining = ( image->len - png->offset ); - if ( remaining < sizeof ( header ) ) { - DBGC ( image, "PNG %s truncated chunk header at offset " - "%zd\n", image->name, png->offset ); + if ( remaining < ( sizeof ( header ) + sizeof ( footer ) ) ) { + DBGC ( image, "PNG %s truncated chunk header/footer " + "at offset %zd\n", image->name, png->offset ); rc = -EINVAL; goto err_truncated; } @@ -936,10 +936,10 @@ static int png_pixbuf ( struct image *image, struct pixel_buffer **pixbuf ) { /* Validate chunk length */ chunk_len = ntohl ( header.len ); - if ( remaining < ( sizeof ( header ) + chunk_len + + if ( chunk_len > ( remaining - sizeof ( header ) - sizeof ( footer ) ) ) { - DBGC ( image, "PNG %s truncated chunk data/footer at " - "offset %zd\n", image->name, png->offset ); + DBGC ( image, "PNG %s truncated chunk data at offset " + "%zd\n", image->name, png->offset ); rc = -EINVAL; goto err_truncated; } |