[Extractor-gtk-cvslog] SF.net SVN: extractor-gtk: [41] trunk/extractor/generic.c

[<som...@us...>]

Revision: 41
          http://extractor-gtk.svn.sourceforge.net/extractor-gtk/?rev=41&view=rev
Author:   someone-guy
Date:     2007-09-16 04:43:44 -0700 (Sun, 16 Sep 2007)

Log Message:
-----------
More restrictive bmp detection

Modified Paths:
--------------
    trunk/extractor/generic.c

Modified: trunk/extractor/generic.c
===================================================================
--- trunk/extractor/generic.c	2007-09-16 11:43:35 UTC (rev 40)
+++ trunk/extractor/generic.c	2007-09-16 11:43:44 UTC (rev 41)
@@ -66,12 +66,23 @@
         break;
     }
     switch (t & 0xffff) {
-      case TAG(0, 0, 'B', 'M'):
+      case TAG(0, 0, 'B', 'M'): {
+        uint32_t len = read_le32(in);
+        uint16_t res1 = read_le16(in);
+        uint16_t res2 = read_le16(in);
+        uint32_t dataoff = read_le32(in);
+        uint32_t bisize = read_le32(in);
+        fseek(in, -16, SEEK_CUR);
+        if (bisize < 40 || bisize > 1024*1024 ||
+            dataoff < bisize + 14 || len < dataoff ||
+            len > 1024*1024*1024)
+          break;
         add_entry(&list, cnt, "bmp");
         list[cnt].start = ftell(in) - 2;
-        list[cnt].len = peek_le32(in);
+        list[cnt].len = len;
         cnt++;
         break;
+      }
       case 0xffd9:
         for (i = 0; i < cnt; i++) {
           if (list[i].priv == (void *)1 && list[i].len == 0)


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.