liblas/liblas_CVE-2018-20536.patch

16 lines
953 B
Diff

diff -rupN --no-dereference libLAS-d76a061f33a69a36ab116cd939c5d444b301efd8/src/spatialreference.cpp libLAS-d76a061f33a69a36ab116cd939c5d444b301efd8-new/src/spatialreference.cpp
--- libLAS-d76a061f33a69a36ab116cd939c5d444b301efd8/src/spatialreference.cpp 2020-06-08 11:37:26.871015429 +0200
+++ libLAS-d76a061f33a69a36ab116cd939c5d444b301efd8-new/src/spatialreference.cpp 2020-06-08 11:37:26.873015404 +0200
@@ -516,8 +516,9 @@ const GTIF* SpatialReference::GetGTIF()
// The '+ 1' accounts for the header itself.
int count = (header->numKeys + 1) * 4;
short *data_s = reinterpret_cast<short *>( &(data[0]));
-
- ST_SetKey(m_tiff, record.GetRecordId(), count, STT_SHORT, data_s);
+ if(std::size_t(count) <= data.size() / sizeof(short)) {
+ ST_SetKey(m_tiff, record.GetRecordId(), count, STT_SHORT, data_s);
+ }
}
}