From d1e9237fdaf8a2e5ba5993fbd0efa9a016b4cc6e Mon Sep 17 00:00:00 2001 From: Jorge Arellano Cid Date: Fri, 19 Jun 2009 19:07:47 -0400 Subject: Added image size sanity checks --- src/jpeg.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'src/jpeg.c') diff --git a/src/jpeg.c b/src/jpeg.c index 212b61f6..09bdfb3d 100644 --- a/src/jpeg.c +++ b/src/jpeg.c @@ -279,6 +279,16 @@ static void Jpeg_write(DilloJpeg *jpeg, void *Buf, uint_t BufSize) !(a_Capi_get_flags(jpeg->url) & CAPI_Completed)) jpeg->cinfo.buffered_image = TRUE; + /* check max image size */ + if ((uint_t)jpeg->cinfo.image_width * + (uint_t)jpeg->cinfo.image_height > IMAGE_MAX_W * IMAGE_MAX_H) { + MSG("Jpeg_write: suspicious image size request %ux%u\n", + (uint_t)jpeg->cinfo.image_width, + (uint_t)jpeg->cinfo.image_height); + jpeg->state = DILLO_JPEG_ERROR; + return; + } + a_Dicache_set_parms(jpeg->url, jpeg->version, jpeg->Image, (uint_t)jpeg->cinfo.image_width, (uint_t)jpeg->cinfo.image_height, -- cgit v1.2.3