From d942fea1cf7891818de357e08319d881b0f2f0df Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>

Date: Sun, 25 Feb 2018 13:28:28 -0500

Subject: [PATCH 5/5] Bug 105204 - Fix a buffer overflow in PSD parser

---

 source/XMPFiles/FormatSupport/PSIR_FileWriter.cpp | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/source/XMPFiles/FormatSupport/PSIR_FileWriter.cpp b/source/XMPFiles/FormatSupport/PSIR_FileWriter.cpp

index 0e57b49..bed14b0 100644

--- a/source/XMPFiles/FormatSupport/PSIR_FileWriter.cpp

+++ b/source/XMPFiles/FormatSupport/PSIR_FileWriter.cpp

@@ -291,6 +291,12 @@ void PSIR_FileWriter::ParseFileResources ( LFA_FileRef fileRef, XMP_Uns32 length

 		ioBuf.ptr += paddedLen;	// Move to the data length.

 		XMP_Uns32 dataLen   = GetUns32BE(ioBuf.ptr);

 		XMP_Uns32 dataTotal = ((dataLen + 1) & 0xFFFFFFFEUL);	// Round up to an even total.

+		// See bug https://bugs.freedesktop.org/show_bug.cgi?id=105204

+		// If dataLen is 0xffffffff, then dataTotal might be 0

+		// and therefor make the CheckFileSpace test pass.

+		if (dataTotal < dataLen) {

+			break;

+		}

 		ioBuf.ptr += 4;	// Advance to the resource data.

 		XMP_Int64 thisDataPos = ioBuf.filePos + (ioBuf.ptr - ioBuf.data);

-- 

2.17.2