From 90ba6ce264e8ad0ae984e22c172e2267ab2eb4b7 Mon Sep 17 00:00:00 2001 From: jmestwa-coder Date: Sat, 20 Jun 2026 21:23:30 +0530 Subject: reject oversized received array in pdf417 ErrorCorrection.decode (#2097) --- .../java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'core/src/main/java') diff --git a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java index 06bd06d82..a0b0a22a5 100644 --- a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java +++ b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java @@ -46,6 +46,12 @@ public final class ErrorCorrection { int numECCodewords, int[] erasures) throws ChecksumException { + if (received.length > field.getSize()) { + // A codeword cannot be longer than the field; otherwise erasure and error positions + // index past the exponent table in exp()/log(). + throw ChecksumException.getChecksumInstance(); + } + ModulusPoly poly = new ModulusPoly(field, received); int[] S = new int[numECCodewords]; boolean error = false; -- cgit v1.2.3