mirror of
https://git.code.sf.net/p/zint/code
synced 2026-09-14 00:08:53 +00:00
DOTCODE: fix not validating ECI in every segment
Previously, only symbol->eci was checked against the 811799 upper bound. Invalid ECI on non-first segments went unchecked, so codeword a = (eci - 40) / 12769 + 40 could exceed 113, causing an out-of-bounds read of dc_dot_patterns[113] in dc_make_dotstream().
This commit is contained in:
+4
-2
@@ -1214,9 +1214,11 @@ INTERNAL int zint_dotcode(struct zint_symbol *symbol, struct zint_seg segs[], co
|
||||
char *dot_array;
|
||||
unsigned char *masked_codeword_array;
|
||||
|
||||
if (symbol->eci > 811799) {
|
||||
for (i = 0; i < seg_count; i++) {
|
||||
if (segs[i].eci > 811799) {
|
||||
return z_errtxtf(ZINT_ERROR_INVALID_OPTION, symbol, 525, "ECI code '%d' out of range (0 to 811799)",
|
||||
symbol->eci);
|
||||
segs[i].eci);
|
||||
}
|
||||
}
|
||||
|
||||
if (symbol->option_2 > 0) {
|
||||
|
||||
Reference in New Issue
Block a user