detect RLE overflow in radiance

old-style radiance RLE could overflow harmlessly see https://oss-fuzz.com/testcase-detail/4918518961930240
2020-07-28 14:03:58 +01:00 · 2020-07-28 14:03:58 +01:00 · ba45c87b50
commit ba45c87b50
parent 58b6d73a70
1 changed files with 5 additions and 0 deletions
--- a/libvips/foreign/radiance.c
+++ b/libvips/foreign/radiance.c
@ -554,6 +554,11 @@ scanline_read_old( VipsSbuf *sbuf, COLR *scanline, int width )
 			}

 			rshift += 8;
+
+			/* This can happen with badly-formed input files.
+			 */
+			if( rshift > 24 )
+				return( -1 );
 		} 
 		else {
 			scanline += 1;