From f92b2b06c394f421ebbf794ca538d62042c220eb Mon Sep 17 00:00:00 2001 From: Connor-Jay Dunn Date: Mon, 7 Sep 2026 01:16:50 +0100 Subject: [PATCH] DOTCODE: fix not validating ECI in every segment Previously, only symbol->eci was checked against the 811799 upper bound. Invalid ECI on non-first segments went unchecked, so codeword a = (eci - 40) / 12769 + 40 could exceed 113, causing an out-of-bounds read of dc_dot_patterns[113] in dc_make_dotstream(). --- backend/dotcode.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/backend/dotcode.c b/backend/dotcode.c index 55c5e432..640403f4 100644 --- a/backend/dotcode.c +++ b/backend/dotcode.c @@ -1214,9 +1214,11 @@ INTERNAL int zint_dotcode(struct zint_symbol *symbol, struct zint_seg segs[], co char *dot_array; unsigned char *masked_codeword_array; - if (symbol->eci > 811799) { - return z_errtxtf(ZINT_ERROR_INVALID_OPTION, symbol, 525, "ECI code '%d' out of range (0 to 811799)", - symbol->eci); + for (i = 0; i < seg_count; i++) { + if (segs[i].eci > 811799) { + return z_errtxtf(ZINT_ERROR_INVALID_OPTION, symbol, 525, "ECI code '%d' out of range (0 to 811799)", + segs[i].eci); + } } if (symbol->option_2 > 0) {