From 1b08dc2917b5d5972a3f87be3e9b76a4f3398d8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>
Date: Mon, 14 Aug 2017 23:57:51 -0400
Subject: [PATCH 1/5] Bug 102151 - RIFF: fix an infinite loop cause by an
overflow
---
source/XMPFiles/FormatSupport/RIFF.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/source/XMPFiles/FormatSupport/RIFF.cpp b/source/XMPFiles/FormatSupport/RIFF.cpp
index 3992edd..00f67e5 100644
--- a/source/XMPFiles/FormatSupport/RIFF.cpp
+++ b/source/XMPFiles/FormatSupport/RIFF.cpp
@@ -155,7 +155,8 @@ Chunk::Chunk( ContainerChunk* parent, RIFF_MetaHandler* handler, bool skip, Chun
this->oldPos = LFA_Tell( file );
this->id = LFA_ReadUns32_LE( file );
- this->oldSize = LFA_ReadUns32_LE( file ) + 8;
+ this->oldSize = LFA_ReadUns32_LE( file );
+ this->oldSize += 8;
// Make sure the size is within expected bounds.
XMP_Int64 chunkEnd = this->oldPos + this->oldSize;
--
2.17.2