From 8fa175c371143f36846c7a88201ce77deae8826c Mon Sep 17 00:00:00 2001
From: fedotoff <fedotoff@ispras.ru>
Date: Sun, 5 Feb 2023 15:14:33 +0300
Subject: [PATCH] Fix capacity overflow in JpegReader

---
 src/decoder/image.rs | 4 ++++
 src/decoder/mod.rs   | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/src/decoder/image.rs b/src/decoder/image.rs
index 6d82d7f..bfad56b 100644
--- a/src/decoder/image.rs
+++ b/src/decoder/image.rs
@@ -458,6 +458,7 @@ impl Image {
         output_width: usize,
         byte_order: ByteOrder,
         chunk_index: u32,
+        limits: &Limits,
     ) -> TiffResult<()> {
         // Validate that the provided buffer is of the expected type.
         let color_type = self.colortype()?;
@@ -511,6 +512,9 @@ impl Image {
                 .ok_or(TiffError::FormatError(
                     TiffFormatError::InconsistentSizesEncountered,
                 ))?;
+        if *compressed_bytes > limits.intermediate_buffer_size as u64 {
+            return Err(TiffError::LimitsExceeded);
+        }
 
         let byte_len = buffer.byte_len();
         let compression_method = self.compression_method;
diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs
index 5fa1812..0612db9 100644
--- a/src/decoder/mod.rs
+++ b/src/decoder/mod.rs
@@ -1042,6 +1042,7 @@ impl<R: Read + Seek> Decoder<R> {
             output_width,
             byte_order,
             chunk_index,
+            &self.limits,
         )?;
 
         Ok(())
@@ -1168,6 +1169,7 @@ impl<R: Read + Seek> Decoder<R> {
                 width as usize,
                 byte_order,
                 chunk as u32,
+                &self.limits,
             )?;
         }