diff --git a/cpp/BitBuffer.cpp b/cpp/BitBuffer.cpp index 4b48cb7..c4fad2b 100644 --- a/cpp/BitBuffer.cpp +++ b/cpp/BitBuffer.cpp @@ -22,6 +22,7 @@ * Software. */ +#include #include #include "BitBuffer.hpp" @@ -44,8 +45,10 @@ std::vector qrcodegen::BitBuffer::getBytes() const { void qrcodegen::BitBuffer::appendBits(uint32_t val, int len) { if (len < 0 || len > 32 || (len < 32 && (val >> len) != 0)) throw "Value out of range"; - size_t newBitLen = bitLength + len; - while (data.size() * 8 < newBitLen) + if (INT_MAX - bitLength < len) + throw "Buffer too long"; + unsigned int newByteLen = ((unsigned int)bitLength + len + 7) / 8; + while (data.size() < newByteLen) data.push_back(0); for (int i = len - 1; i >= 0; i--, bitLength++) // Append bit by bit data.at(bitLength >> 3) |= ((val >> i) & 1) << (7 - (bitLength & 7)); @@ -53,8 +56,10 @@ void qrcodegen::BitBuffer::appendBits(uint32_t val, int len) { void qrcodegen::BitBuffer::appendData(const QrSegment &seg) { - size_t newBitLen = bitLength + seg.bitLength; - while (data.size() * 8 < newBitLen) + if (INT_MAX - bitLength < seg.bitLength) + throw "Buffer too long"; + unsigned int newByteLen = ((unsigned int)bitLength + seg.bitLength + 7) / 8; + while (data.size() < newByteLen) data.push_back(0); for (int i = 0; i < seg.bitLength; i++, bitLength++) { // Append bit by bit int bit = (seg.data.at(i >> 3) >> (7 - (i & 7))) & 1; diff --git a/cpp/QrSegment.cpp b/cpp/QrSegment.cpp index 2ae2242..6bb3f5e 100644 --- a/cpp/QrSegment.cpp +++ b/cpp/QrSegment.cpp @@ -22,6 +22,7 @@ * Software. */ +#include #include #include "BitBuffer.hpp" #include "QrSegment.hpp" @@ -139,7 +140,10 @@ int qrcodegen::QrSegment::getTotalBits(const std::vector &segs, int v // Fail if segment length value doesn't fit in the length field's bit-width if (seg.numChars >= (1 << ccbits)) return -1; - result += 4 + ccbits + seg.bitLength; + long temp = (long)result + 4 + ccbits + seg.bitLength; + if (temp > INT_MAX) + return -1; + result = temp; } return result; }