diff --git a/src/jp2image.cpp b/src/jp2image.cpp index 0de088d..d5cd134 100644 --- a/src/jp2image.cpp +++ b/src/jp2image.cpp @@ -18,6 +18,10 @@ * Foundation, Inc., 51 Franklin Street, 5th Floor, Boston, MA 02110-1301 USA. */ +/* + File: jp2image.cpp +*/ + // ***************************************************************************** // included header files @@ -193,16 +197,6 @@ namespace Exiv2 return result; } -static void boxes_check(size_t b,size_t m) -{ - if ( b > m ) { -#ifdef EXIV2_DEBUG_MESSAGES - std::cout << "Exiv2::Jp2Image::readMetadata box maximum exceeded" << std::endl; -#endif - throw Error(kerCorruptedMetadata); - } -} - void Jp2Image::readMetadata() { #ifdef EXIV2_DEBUG_MESSAGES @@ -225,12 +219,9 @@ static void boxes_check(size_t b,size_t m) Jp2BoxHeader subBox = {0,0}; Jp2ImageHeaderBox ihdr = {0,0,0,0,0,0,0,0}; Jp2UuidBox uuid = {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}}; - size_t boxes = 0 ; - size_t boxem = 1000 ; // boxes max while (io_->read((byte*)&box, sizeof(box)) == sizeof(box)) { - boxes_check(boxes++,boxem ); position = io_->tell(); box.length = getLong((byte*)&box.length, bigEndian); box.type = getLong((byte*)&box.type, bigEndian); @@ -260,12 +251,8 @@ static void boxes_check(size_t b,size_t m) while (io_->read((byte*)&subBox, sizeof(subBox)) == sizeof(subBox) && subBox.length ) { - boxes_check(boxes++, boxem) ; subBox.length = getLong((byte*)&subBox.length, bigEndian); subBox.type = getLong((byte*)&subBox.type, bigEndian); - if (subBox.length > io_->size() ) { - throw Error(kerCorruptedMetadata); - } #ifdef EXIV2_DEBUG_MESSAGES std::cout << "Exiv2::Jp2Image::readMetadata: " << "subBox = " << toAscii(subBox.type) << " length = " << subBox.length << std::endl; @@ -321,9 +308,7 @@ static void boxes_check(size_t b,size_t m) } io_->seek(restore,BasicIo::beg); - if ( io_->seek(subBox.length, Exiv2::BasicIo::cur) != 0 ) { - throw Error(kerCorruptedMetadata); - } + io_->seek(subBox.length, Exiv2::BasicIo::cur); restore = io_->tell(); } break; diff --git a/tests/bugfixes/github/test_CVE_2017_17725.py b/tests/bugfixes/github/test_CVE_2017_17725.py index 670a75d..1127b98 100644 --- a/tests/bugfixes/github/test_CVE_2017_17725.py +++ b/tests/bugfixes/github/test_CVE_2017_17725.py @@ -11,7 +11,7 @@ class TestCvePoC(metaclass=system_tests.CaseMeta): filename = "$data_path/poc_2017-12-12_issue188" commands = ["$exiv2 " + filename] stdout = [""] - stderr = ["""$exiv2_exception_message """ + filename + """: -$kerCorruptedMetadata + stderr = ["""$exiv2_overflow_exception_message """ + filename + """: +$addition_overflow_message """] retval = [1]