From 470c01f29036529236b0cfe1467c96dd23b63c51 Mon Sep 17 00:00:00 2001 From: AiChaosN Date: Mon, 20 Jan 2025 17:19:12 +0800 Subject: [PATCH 1/2] add ckeck point Signed-off-by: AiChaosN --- libexif/exif-data.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libexif/exif-data.c b/libexif/exif-data.c index 6504bc5..4ccd6ea 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -50,6 +50,8 @@ #define JPEG_MARKER_APP1 0xe1 #undef JPEG_HEADER_LEN #define JPEG_HEADER_LEN 6 +#define SHORT_SIZE 2 +#define ENTRY_SIZE 12 #define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) @@ -606,6 +608,13 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, for (i = 0; i < n; i++) { + /* Check if we have enough data. */ + if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, SHORT_SIZE)) { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", + "Tag data past end of buffer (%u+2 > %u)", offset + ENTRY_SIZE * i, ds); + return; + } + tag = exif_get_short (d + offset + 12 * i, data->priv->order); switch (tag) { case EXIF_TAG_EXIF_IFD_POINTER: From 7eca90db631b3540bc9218069a71955e3a26effc Mon Sep 17 00:00:00 2001 From: AiChaosN Date: Tue, 21 Jan 2025 16:24:40 +0800 Subject: [PATCH 2/2] ok Signed-off-by: AiChaosN --- libexif/exif-data.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libexif/exif-data.c b/libexif/exif-data.c index 4ccd6ea..034f40d 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -50,7 +50,6 @@ #define JPEG_MARKER_APP1 0xe1 #undef JPEG_HEADER_LEN #define JPEG_HEADER_LEN 6 -#define SHORT_SIZE 2 #define ENTRY_SIZE 12 #define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) @@ -609,7 +608,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, for (i = 0; i < n; i++) { /* Check if we have enough data. */ - if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, SHORT_SIZE)) { + if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, sizeof(ExifShort))) { exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", "Tag data past end of buffer (%u+2 > %u)", offset + ENTRY_SIZE * i, ds); return;