From e0557f60dd1a6130c481e3ab4f3787bf1125941a Mon Sep 17 00:00:00 2001 From: Tom Sepez Date: Wed, 11 Mar 2015 14:41:17 -0700 Subject: XFA: bound memcpy length in _png_load_bmp_attribute() BUG=466338 R=thestig@chromium.org Review URL: https://codereview.chromium.org/997273002 --- core/src/fxcodec/codec/fx_codec_png.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'core/src/fxcodec') diff --git a/core/src/fxcodec/codec/fx_codec_png.cpp b/core/src/fxcodec/codec/fx_codec_png.cpp index 8c26381514..ea5ffaf68a 100644 --- a/core/src/fxcodec/codec/fx_codec_png.cpp +++ b/core/src/fxcodec/codec/fx_codec_png.cpp @@ -69,8 +69,9 @@ static void _png_load_bmp_attribute(png_structp png_ptr, png_infop info_ptr, CFX buf = "Time"; if (!FXSYS_memcmp32(buf, text[i].key, FX_MIN(len, FXSYS_strlen(buf)))) { if (!bTime) { - FXSYS_memset32(pAttribute->m_strTime, 0, 20); - FXSYS_memcpy32(pAttribute->m_strTime, text[i].text, text[i].text_length); + FXSYS_memset32(pAttribute->m_strTime, 0, sizeof(pAttribute->m_strTime)); + FXSYS_memcpy32(pAttribute->m_strTime, text[i].text, + FX_MIN(sizeof(pAttribute->m_strTime) - 1, text[i].text_length)); } } else { buf = "Author"; -- cgit v1.2.3