Prevent bounds exception in BmpReader

Contributes to #561
drewnoakes · Apr 3, 2022 · cde596d · cde596d
1 parent a1ddc1b
commit cde596d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/Source/com/drew/metadata/bmp/BmpReader.java b/Source/com/drew/metadata/bmp/BmpReader.java
@@ -362,6 +362,10 @@ protected void readBitmapHeader(@NotNull final SequentialReader reader, final @N
                 if (csType == ColorSpaceType.PROFILE_EMBEDDED.getValue() || csType == ColorSpaceType.PROFILE_LINKED.getValue()) {
                     long profileOffset = reader.getUInt32();
                     int profileSize = reader.getInt32();
+                    if (profileSize < 0) {
+                        directory.addError("Invalid profile size " + profileSize);
+                        return;
+                    }
                     if (reader.getPosition() > headerOffset + profileOffset) {
                         directory.addError("Invalid profile data offset 0x" + Long.toHexString(headerOffset + profileOffset));
                         return;