diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs index 12a11e5..61af67e 100644 --- a/src/decoder/mod.rs +++ b/src/decoder/mod.rs @@ -1372,7 +1372,17 @@ impl Decoder { let jpeg_tables: Option> = match self.find_tag(Tag::JPEGTables) { Ok(None) => None, - Ok(_) => Some(self.get_tag_u8_vec(Tag::JPEGTables)?), + Ok(_) => { + let vec = self.get_tag_u8_vec(Tag::JPEGTables)?; + + if vec.len() < 2 { + return Err(TiffError::FormatError( + TiffFormatError::InvalidTagValueType(Tag::JPEGTables), + )); + } + + Some(vec) + } Err(e) => return Err(e), }; diff --git a/src/decoder/stream.rs b/src/decoder/stream.rs index 294a1c8..c73e08c 100644 --- a/src/decoder/stream.rs +++ b/src/decoder/stream.rs @@ -225,6 +225,12 @@ impl JpegReader { match jpeg_tables { Some(tables) => { + assert!( + tables.len() >= 2, + "jpeg_tables, if given, must be at least 2 bytes long. Got {:?}", + tables + ); + let mut jpeg_data = tables.clone(); let truncated_length = jpeg_data.len() - 2; jpeg_data.truncate(truncated_length); diff --git a/tests/decode_images.rs b/tests/decode_images.rs index 33dc9b5..e13273b 100644 --- a/tests/decode_images.rs +++ b/tests/decode_images.rs @@ -423,3 +423,29 @@ fn oom_2() { unexpected => panic!("Unexpected error {}", unexpected), } } + +#[test] +fn invalid_jpeg_tag() { + use tiff::tags; + use tiff::{TiffError, TiffFormatError}; + + let image = [ + 73, 73, 42, 0, 8, 0, 0, 0, 15, 0, 0, 254, 44, 1, 0, 0, 0, 0, 0, 32, 0, 0, 0, 1, 4, 0, 1, 0, + 0, 0, 0, 1, 0, 0, 91, 1, 1, 0, 0, 0, 0, 0, 242, 4, 0, 0, 0, 22, 0, 56, 77, 0, 77, 1, 0, 0, + 73, 42, 0, 1, 4, 0, 1, 0, 0, 0, 4, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 158, 0, 0, 251, 3, 1, + 3, 0, 1, 0, 0, 0, 7, 0, 0, 0, 6, 1, 3, 0, 1, 0, 0, 0, 2, 0, 0, 0, 17, 1, 4, 0, 1, 0, 0, 0, + 0, 0, 0, 0, 1, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 4, 61, 1, 18, 0, 1, 0, 0, 0, 202, 0, 0, 0, 17, + 1, 100, 0, 129, 0, 0, 0, 0, 0, 0, 0, 232, 254, 252, 255, 254, 255, 255, 255, 1, 29, 0, 0, + 22, 1, 3, 0, 1, 0, 0, 0, 16, 0, 0, 0, 23, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 123, 73, 254, 0, + 73, + ]; + + let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap(); + + let err = decoder.read_image().unwrap_err(); + + match err { + TiffError::FormatError(TiffFormatError::InvalidTagValueType(tags::Tag::JPEGTables)) => {} + unexpected => panic!("Unexpected error {}", unexpected), + } +}