From 5ed748716cdde45bfdc7196d06eb85b3da0ea98a Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meissner@suse.de>
Date: Sat, 27 Apr 2019 19:53:41 +0200
Subject: [PATCH] check filelist vs index size

---
 camlibs/pccam300/pccam300.c            | 7 +++++--
 camlibs/soundvision/tiger_fastflicks.c | 5 +++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/camlibs/pccam300/pccam300.c b/camlibs/pccam300/pccam300.c
index bcbcbdc83..014b2e2d8 100644
--- a/camlibs/pccam300/pccam300.c
+++ b/camlibs/pccam300/pccam300.c
@@ -152,7 +152,7 @@ pccam300_get_file (GPPort *port, GPContext *context, int index,
                    unsigned char **data, unsigned int *size,
                    unsigned int *type)
 {
-	unsigned int data_size;
+	unsigned int data_size, alloc_size;
 	int r;
 	uint8_t *buf = NULL;
 
@@ -166,7 +166,10 @@ pccam300_get_file (GPPort *port, GPContext *context, int index,
 	 * bytes long. The first 0x200 bytes of the data appear to be
 	 * garbage, they are overwritten by the header. */
 	*size = data_size + 623 - 0x200;
-	if (!(buf = malloc (*size)))
+
+	alloc_size = *size;
+	if (alloc_size < 623) alloc_size = 623;
+	if (!(buf = malloc (alloc_size)))
 		return GP_ERROR_NO_MEMORY;
 
 	/* Read the data into the buffer overlapping the header area by
diff --git a/camlibs/soundvision/tiger_fastflicks.c b/camlibs/soundvision/tiger_fastflicks.c
index 62f804565..9b28452fc 100644
--- a/camlibs/soundvision/tiger_fastflicks.c
+++ b/camlibs/soundvision/tiger_fastflicks.c
@@ -313,6 +313,11 @@ int tiger_get_file_list(CameraPrivateLibrary *dev) {
        if (ret < 0) {
           goto list_files_error;
        }
+       if (ret < buflen) {
+          GP_DEBUG("Read only %i instead of %i!", buflen, ret);
+          ret=GP_ERROR_NO_MEMORY;
+          goto list_files_error;
+       }
        
  
        if (dev->file_list) free(dev->file_list);