--- jhead-3.00.orig/exif.c +++ jhead-3.00/exif.c @@ -1019,7 +1019,7 @@ void process_EXIF (unsigned char * ExifS FirstOffset = Get32u(ExifSection+12); if (FirstOffset < 8 || FirstOffset > 16){ - if (FirstOffset < 16 || FirstOffset > length-16){ + if (FirstOffset < 16 || length < 16 || FirstOffset > length-16){ ErrNonfatal("invalid offset for first Exif IFD value",0,0); return; }