reject oversized received array in pdf417 ErrorCorrection.decode (#2097)

1 files changed, 6 insertions, 0 deletions

diff --git a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
index 06bd06d82..a0b0a22a5 100644
--- a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
+++ b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
@@ -46,6 +46,12 @@ public final class ErrorCorrection {
                     int numECCodewords,
                     int[] erasures) throws ChecksumException {
 
+    if (received.length > field.getSize()) {
+      // A codeword cannot be longer than the field; otherwise erasure and error positions
+      // index past the exponent table in exp()/log().
+      throw ChecksumException.getChecksumInstance();
+    }
+
     ModulusPoly poly = new ModulusPoly(field, received);
     int[] S = new int[numECCodewords];
     boolean error = false;