PALSARJaxa: avoid out-of-range access (likely master only / related t…

…o RFC105) Fixes https://issues.oss-fuzz.com/issues/390565839 and https://issues.oss-fuzz.com/issues/390464881
OSGeo · Jan 18, 2025 · ba185c4 · ba185c4
1 parent 76b0d5c
commit ba185c4
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/frmts/jaxapalsar/jaxapalsardataset.cpp b/frmts/jaxapalsar/jaxapalsardataset.cpp
@@ -513,10 +513,13 @@ int PALSARJaxaDataset::Identify(GDALOpenInfo *poOpenInfo)
         return 0;
 
     /* First, check that this is a PALSAR image indeed */
-    if (!STARTS_WITH_CI((char *)(poOpenInfo->pabyHeader + 60), "AL") ||
-        !STARTS_WITH_CI(
-            CPLGetBasenameSafe(poOpenInfo->pszFilename).substr(4).c_str(),
-            "ALPSR"))
+    if (!STARTS_WITH_CI((char *)(poOpenInfo->pabyHeader + 60), "AL"))
+    {
+        return 0;
+    }
+    const std::string osBasename = CPLGetBasenameSafe(poOpenInfo->pszFilename);
+    if (osBasename.size() < 9 ||
+        !STARTS_WITH_CI(osBasename.c_str() + 4, "ALPSR"))
     {
         return 0;
     }