Check that ifd offsets donot go beyond header. Fixes #54

oozcitak · May 3, 2018 · 946f72f · 946f72f
1 parent 64d6c8f
commit 946f72f
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/ExifLibrary/JPEGFile.cs b/ExifLibrary/JPEGFile.cs
@@ -614,9 +614,13 @@ private void ReadExifAPP1()
                 }
 
                 // 1st IFD pointer
-                int firstifdpointer = (int)conv.ToUInt32(header, ifdoffset + 2 + 12 * fieldcount);
-                if (firstifdpointer != 0)
-                    ifdqueue.Add(firstifdpointer, IFD.First);
+                int firstifdoffset = ifdoffset + 2 + 12 * fieldcount;
+                if (firstifdoffset + 4 <= header.Length)
+                {
+                    int firstifdpointer = (int)conv.ToUInt32(header, firstifdoffset);
+                    if (firstifdpointer != 0 && firstifdpointer + 2 <= header.Length)
+                        ifdqueue.Add(firstifdpointer, IFD.First);
+                }
                 // Read thumbnail
                 if (thumboffset != -1 && thumblength != 0 && Thumbnail == null)
                 {