From 53738879bd6bc400d27b96cf0fe759dadc9f4fb0 Mon Sep 17 00:00:00 2001
From: sun_hai_10 <sunhai10@huawei.com>
Date: Wed, 14 Jun 2023 16:00:24 +0800
Subject: [PATCH] fix call get_unaligned_be32 heap buffer overflow

---
 src/cairo-image-info.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/cairo-image-info.c b/src/cairo-image-info.c
index d147e37..0310c4b 100644
--- a/src/cairo-image-info.c
+++ b/src/cairo-image-info.c
@@ -190,7 +190,7 @@ _jpx_match_box (const unsigned char *p, const unsigned char *end, uint32_t type)
 static const unsigned char *
 _jpx_find_box (const unsigned char *p, const unsigned char *end, uint32_t type)
 {
-    while (p < end) {
+    while ((p < end) && (p + 4 < end)) {
 	if (_jpx_match_box (p, end, type))
 	    return p;
 	p = _jpx_next_box (p);
@@ -346,6 +346,9 @@ _jbig2_get_next_segment (const unsigned char  *p,
     big_page_size = (p[4] & 0x40) != 0;
     p += 5;
 
+    if (p + 4 >= end)
+        return NULL;
+
     num_segs = p[0] >> 5;
     if (num_segs == 7) {
 	num_segs = get_unaligned_be32 (p) & 0x1fffffff;
-- 
2.23.0