If clength gets real big (for some broken JBIG reason) then it can make i

"wrap" and makes problems for the loop.

diff --git a/faxd/CopyQuality.c++ b/faxd/CopyQuality.c++
index 0f1e1a824ad05c7d919f1b6f9851de2fe3f0bdea..d778aa54024f95bb7b74793026f807d4e260962f 100644 (file)
--- a/faxd/CopyQuality.c++
+++ b/faxd/CopyQuality.c++
@@ -657,6 +657,7 @@ FaxModem::writeECMData(TIFF* tif, u_char* buf, u_int cc, const Class2Params& par
                            sdnormcount = 0;
                        }
                        u_long clength = 256*256*256*buf[i+2]+256*256*buf[i+3]+256*buf[i+4]+buf[i+5];
+                       if (clength > 256) clength = 256;               // keep it sane
                        fxStr comment = "";
                        for (u_long cpos = 0; i+6+cpos < cc && cpos < clength; cpos++) {
                            if (!isprint(buf[i+6+cpos])) break;         // only printables