From bb94dc82d75cb48377b05f2813f74a9744eda9ab Mon Sep 17 00:00:00 2001 From: jmestwa-coder Date: Sat, 30 May 2026 08:36:14 +0530 Subject: avoid out-of-bounds read for NS sequence in maxicode getMessage (#2079) --- .../com/google/zxing/maxicode/decoder/DecodedBitStreamParser.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'core/src/main/java/com') diff --git a/core/src/main/java/com/google/zxing/maxicode/decoder/DecodedBitStreamParser.java b/core/src/main/java/com/google/zxing/maxicode/decoder/DecodedBitStreamParser.java index 9ebf7e8a3..d62e5a910 100644 --- a/core/src/main/java/com/google/zxing/maxicode/decoder/DecodedBitStreamParser.java +++ b/core/src/main/java/com/google/zxing/maxicode/decoder/DecodedBitStreamParser.java @@ -158,7 +158,7 @@ final class DecodedBitStreamParser { return sb.toString(); } - private static String getMessage(byte[] bytes, int start, int len) { + private static String getMessage(byte[] bytes, int start, int len) throws FormatException { StringBuilder sb = new StringBuilder(); int shift = -1; int set = 0; @@ -194,6 +194,9 @@ final class DecodedBitStreamParser { shift = 3; break; case NS: + if (i + 5 >= start + len) { + throw FormatException.getFormatInstance(); + } int nsval = (bytes[++i] << 24) + (bytes[++i] << 18) + (bytes[++i] << 12) + (bytes[++i] << 6) + bytes[++i]; sb.append(new DecimalFormat("000000000").format(nsval)); break; -- cgit v1.2.3