[libexif-cvs] libexif/libexif/canon exif-mnote-data-canon.c, 1.21, 1.22

[Lutz M. <lu...@us...>]

Update of /cvsroot/libexif/libexif/libexif/canon
In directory ddv4jf1.ch3.sourceforge.com:/tmp/cvs-serv31085/libexif/canon

Modified Files:
	exif-mnote-data-canon.c 
Log Message:
2009-03-21  Lutz Mueller <lu...@us...>

	Meder Kydyraliev <me...@gm...> suggested to add some sanity
	checks:

	* libexif/exif-data.c (exif_data_load_entry),
	  (exif_data_load_data_thumbnail)
	* libexif/canon/exif_mnote-data-canon.c
          (exif_mnote_data_canon_load)
	* libexif/fuji/exif-mnote-data-fuji.c
	  (exif_mnote_data_fuji_load)
	* libexif/olympus/exif-mnote-data-olympus.c
          (exif_mnote_data_olympus_load)
	* libexif/pentax/exif-mnote-data-pentax.c
	  (exif_mnote_data_pentax_load)


Index: exif-mnote-data-canon.c
===================================================================
RCS file: /cvsroot/libexif/libexif/libexif/canon/exif-mnote-data-canon.c,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -p -d -r1.21 -r1.22
--- exif-mnote-data-canon.c	16 Mar 2009 22:36:13 -0000	1.21
+++ exif-mnote-data-canon.c	21 Mar 2009 22:03:09 -0000	1.22
@@ -241,7 +241,7 @@ exif_mnote_data_canon_load (ExifMnoteDat
 		}
 		o += 8;
 		if (s > 4) o = exif_get_long (buf + o, n->order) + 6;
-		if (o + s > buf_size) {
+		if ((o + s < s) || (o + s < o) || (o + s > buf_size)) {
 			exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
 				"ExifMnoteCanon",
 				"Tag data past end of buffer (%u > %u)",