From dbf72fbb5d7b7b02ffd4939559e4640a927f686f Mon Sep 17 00:00:00 2001
From: Marcus Meissner <marcus@jet.franken.de>
Date: Tue, 28 Feb 2017 21:33:30 +0100
Subject: [PATCH] final try to fix OLC entry calculation (AFL)

---
 camlibs/ptp2/ptp-pack.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c
index 7bb49d654..30b130108 100644
--- a/camlibs/ptp2/ptp-pack.c
+++ b/camlibs/ptp2/ptp-pack.c
@@ -1861,7 +1861,7 @@ ptp_unpack_CANON_changes (PTPParams *params, unsigned char* data, int datasize,
 		}
 		if ((size == 8) && (type == 0))
 			break;
-		if (curdata - data + size >= datasize) {
+		if ((curdata - data) + size >= datasize) {
 			ptp_debug (params, "canon eos event decoder ran over supplied data, skipping entries");
 			break;
 		}
@@ -1869,8 +1869,10 @@ ptp_unpack_CANON_changes (PTPParams *params, unsigned char* data, int datasize,
 			unsigned int j;
 
 			entries++;
+			if (size < 12+2)
+				break;
 			for (j=0;j<31;j++)
-				if (dtoh32a(curdata+12) & (1<<j))
+				if (dtoh16a(curdata+12) & (1<<j))
 					entries++;
 		}
 		curdata += size;
@@ -2336,6 +2338,11 @@ ptp_unpack_CANON_changes (PTPParams *params, unsigned char* data, int datasize,
 				break;
 			}
 			mask = dtoh16a(curdata+8+4);
+			if (size < 14) {
+				ce[i].type = PTP_CANON_EOS_CHANGES_TYPE_UNKNOWN;
+				ptp_debug (params, "event %d: OLC unexpected size %d", i, size);
+				break;
+			}
 			curoff = 8+4+4;
 			if (mask & CANON_EOS_OLC_BUTTON) {
 				ce[i].type = PTP_CANON_EOS_CHANGES_TYPE_UNKNOWN;