diff --git a/third_party/libertiff/libertiff.hpp b/third_party/libertiff/libertiff.hpp index 1ea5e71d085f..de5fd2ec7706 100644 --- a/third_party/libertiff/libertiff.hpp +++ b/third_party/libertiff/libertiff.hpp @@ -1525,6 +1525,14 @@ class Image { // Out-of-line values. We read a file offset entry.value_offset = m_rc->read(offset, ok); + if (entry.value_offset == 0) + { + // value_offset = 0 for a out-of-line tag is obviously + // wrong and would cause later confusion in readTagAsVector<>, + // so better reject the file. + ok = false; + return; + } if (dataTypeSize > std::numeric_limits::max() / entry.count) {