1
0
mirror of https://git.code.sf.net/p/zint/code synced 2026-09-14 00:08:53 +00:00

DOTCODE: fix not validating ECI in every segment

Previously, only symbol->eci was checked against the 811799 upper
bound. Invalid ECI on non-first segments went unchecked, so codeword
a = (eci - 40) / 12769 + 40 could exceed 113, causing an out-of-bounds
read of dc_dot_patterns[113] in dc_make_dotstream().
This commit is contained in:
Connor-Jay Dunn
2026-09-07 01:16:50 +01:00
parent 6ac010af0e
commit f92b2b06c3
+4 -2
View File
@@ -1214,9 +1214,11 @@ INTERNAL int zint_dotcode(struct zint_symbol *symbol, struct zint_seg segs[], co
char *dot_array;
unsigned char *masked_codeword_array;
if (symbol->eci > 811799) {
for (i = 0; i < seg_count; i++) {
if (segs[i].eci > 811799) {
return z_errtxtf(ZINT_ERROR_INVALID_OPTION, symbol, 525, "ECI code '%d' out of range (0 to 811799)",
symbol->eci);
segs[i].eci);
}
}
if (symbol->option_2 > 0) {