Handle invalid RIFF chunk sizes

Contributes to #561
drewnoakes · Apr 3, 2022 · 7ae0389 · 7ae0389
1 parent ba095b5
commit 7ae0389
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/Source/com/drew/imaging/riff/RiffReader.java b/Source/com/drew/imaging/riff/RiffReader.java
@@ -81,6 +81,10 @@ public void processChunks(SequentialReader reader, int sectionSize, RiffHandler
             while (reader.getPosition() < sectionSize) {
                 String fourCC = new String(reader.getBytes(4));
                 int size = reader.getInt32();
+                if (size <= 0) {
+                    handler.addError("Invalid chunk size: " + size);
+                    break;
+                }
                 if (fourCC.equals("LIST") || fourCC.equals("RIFF")) {
                     String listName = new String(reader.getBytes(4));
                     if (size < 4) {