fix marker pointer address can be decremented by int dataSize.

syoyo · Aug 3, 2023 · 6e8cac3 · 6e8cac3
1 parent adb31d9
commit 6e8cac3
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/tinyexr.h b/tinyexr.h
@@ -5818,15 +5818,20 @@ static bool ReconstructTileOffsets(OffsetData& offset_data,
 
         } else {
 
-          if ((marker + sizeof(int)) >= (head + size)) {
+          if ((marker + sizeof(uint32_t)) >= (head + size)) {
             return false;
           }
 
-          int dataSize;
-          memcpy(&dataSize, marker, sizeof(int));
+          uint32_t dataSize;
+          memcpy(&dataSize, marker, sizeof(uint32_t));
           tinyexr::swap4(&dataSize);
-          marker += sizeof(int);
+          marker += sizeof(uint32_t);
+
           marker += dataSize;
+
+          if (marker >= (head + size)) {
+            return false;
+          }
         }
 
         if (!isValidTile(exr_header, offset_data,