openharmony/third_party_libexif
1
0
Fork 0
mirror of https://github.com/openharmony/third_party_libexif.git synced 2026-07-21 00:26:31 -04:00
Code Issues Packages Projects Releases Wiki Activity

libexif codecheck fix

Browse Source 
Signed-off-by: duanhan <duanhan1@huawei.com>
This commit is contained in:
duanhan
2024-10-23 14:48:58 +08:00
parent 478d980dde
commit 1d8e65a2ab
4 changed files with 60 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libexif/exif-data.c
+3 -1
View File
@@ -432,6 +432,7 @@ exif_data_save_data_entry_general (ExifData *data, ExifEntry *e,
if (e->data) {
unsigned int len = s;
if (e->size < s) len = e->size;
if (CHECKOVERFLOW(6 - JPEG_HEADER_LEN + doff, *ds, len)) return;
memcpy(*d + 6 - JPEG_HEADER_LEN + doff, e->data, len);
} else {
memset(*d + 6 - JPEG_HEADER_LEN + doff, 0, s);
@@ -512,7 +513,8 @@ load_thumbnail_entry (ExifData *data, ExifTag tag, ExifIfd ifd,
* Special case: Tag and format 0. That's against specification
* (at least up to 2.2). But Photoshop writes it anyways.
*/
if (!memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
if (!d || CHECKOVERFLOW(offset + 12 * i, ds, 4) ||
!memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"Skipping empty entry at position %u in '%s'.", i,
exif_ifd_get_name (ifd));
libexif/exif-entry.c
+7 -6
View File
@@ -644,8 +644,8 @@ exif_entry_dump (ExifEntry *e, unsigned int indent)
printf ("%s Format: %i ('%s')\n", buf, e->format,
exif_format_get_name (e->format));
printf ("%s Components: %i\n", buf, (int) e->components);
printf ("%s Offset: %li\n", buf, e->offset);
printf ("%s Size: %i\n", buf, e->size);
printf ("%s Offset: %lu\n", buf, e->offset);
printf ("%s Size: %u\n", buf, e->size);
printf ("%s Value: %s\n", buf, exif_entry_get_value (e, value, sizeof(value)));
}
@@ -1133,9 +1133,9 @@ exif_entry_get_value (ExifEntry *e, char *val, unsigned int maxlen)
break;
}
d = (double) v_rat.numerator / (double) v_rat.denominator;
int g = gcd_uint32_t(v_rat.numerator, v_rat.denominator);
int min_numerator = v_rat.numerator / g;
int min_denominator = v_rat.denominator / g;
unsigned int g = gcd_uint32_t(v_rat.numerator, v_rat.denominator);
unsigned int min_numerator = v_rat.numerator / g;
unsigned int min_denominator = v_rat.denominator / g;
if (d < 1 && d) {
int cd = count_decimal(d);
if (min_numerator == 1) {
@@ -1495,7 +1495,7 @@ void exif_entry_initialize_gps(ExifEntry *e, ExifTag tag) {
e->data = NULL;
} else {
int hasDefault = (info->default_size && info->default_value);
int allocSize = hasDefault ? info->default_size : (exif_format_get_size (e->format) * e->components);
unsigned int allocSize = hasDefault ? info->default_size : (exif_format_get_size (e->format) * e->components);
e->size = allocSize;
e->data = exif_entry_alloc (e, e->size);
if(!e->data) {
@@ -1503,6 +1503,7 @@ void exif_entry_initialize_gps(ExifEntry *e, ExifTag tag) {
return;
}
if(hasDefault) {
if (e->size < info->default_size) return;
memcpy(e->data, info->default_value, info->default_size);
}
}
libexif/huawei/exif-mnote-data-huawei.c
+37 -13
View File
@@ -32,6 +32,7 @@
const int DATA_OR_OFFSET = 4;
const int HUAWEI_HEADER_OFFSET = 8;
const int MAX_DATA_LOAD_TIMES = 10;
const unsigned int MAX_HUAWEI_MNOTE_ENTRY_NUM = 10 * 1000;
const char HUAWEI_HEADER[] = { 'H', 'U', 'A', 'W', 'E', 'I', '\0', '\0',
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
@@ -105,7 +106,10 @@ exif_mnote_data_huawei_malloc_size_data (ExifMnoteData *ne, unsigned int *malloc
unsigned int ifd_size = 2 + n->count * 12 + 4;
*malloc_size = *malloc_size + ifd_size;
for (int i = 0; i < n->count; i++) {
if (n->count > MAX_HUAWEI_MNOTE_ENTRY_NUM) {
return;
}
for (unsigned int i = 0; i < n->count; i++) {
if (n->entries[i].md) {
exif_mnote_data_huawei_malloc_size_data(n->entries[i].md, malloc_size);
ExifMnoteDataHuawei *t_n = n->entries[i].md;
@@ -143,6 +147,9 @@ exif_mnote_data_huawei_save_data (ExifMnoteData *ne, unsigned char *buf,
exif_set_short (buf, n->order, (ExifShort) n->count);
/* Save each entry */
if (n->count > MAX_HUAWEI_MNOTE_ENTRY_NUM) {
return;
}
for (unsigned int i = 0; i < n->count; i++) {
offset = 2 + i * 12;
exif_set_short (buf + offset + 0, n->order, (ExifShort) n->entries[i].tag);
@@ -169,11 +176,18 @@ exif_mnote_data_huawei_save_data (ExifMnoteData *ne, unsigned char *buf,
exif_set_long (buf + offset, n->order, t_offset);
// write data
if (n->entries[i].data)
memcpy (buf + ifd_data_offset + ifd_data_offset_increment, n->entries[i].data, components_size);
if (n->entries[i].data) {
if (CHECKOVERFLOW(ifd_data_offset + ifd_data_offset_increment, buf_size, components_size)) {
continue;
}
memcpy(buf + ifd_data_offset + ifd_data_offset_increment, n->entries[i].data, components_size);
}
ifd_data_offset_increment += components_size;
} else {
if (CHECKOVERFLOW(offset, buf_size, components_size)) {
continue;
}
memcpy (buf + offset, n->entries[i].data, components_size);
}
}
@@ -236,13 +250,12 @@ exif_mnote_data_huawei_load_data (ExifMnoteData *ne, const unsigned char *buf, u
int ret = 0;
ExifMnoteDataHuawei *n = (ExifMnoteDataHuawei *) ne;
const unsigned char *ifd_data = buf + *cur_ifd_data_offset;
if (CHECKOVERFLOW(*cur_ifd_data_offset, buf_size, 2)) {
exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
"ExifMnoteDataHuawei", "Short MakerNote");
return -1;
}
const unsigned char *ifd_data = buf + *cur_ifd_data_offset;
ExifShort count = exif_get_short (ifd_data, n->order);
if (count > 100) {
exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteHuawei", "Too much tags (%d) in Huawei MakerNote", count);
@@ -371,6 +384,9 @@ exif_mnote_data_huawei_load (ExifMnoteData *ne, const unsigned char *buf, unsign
head_offset = 0;
}
if (CHECKOVERFLOW(n->offset + head_offset, buf_size, HUAWEI_HEADER_OFFSET)) {
return;
}
unsigned int order_offset = n->offset + head_offset + HUAWEI_HEADER_OFFSET;
const void *pOrder = buf + order_offset;
@@ -403,9 +419,12 @@ exif_mnote_data_huawei_count_data (ExifMnoteData *ne, MnoteHuaweiEntryCount* ec)
{
ExifMnoteDataHuawei *n = (ExifMnoteDataHuawei *) ne;
if (!ne) return 0;
if (n->count > MAX_HUAWEI_MNOTE_ENTRY_NUM) {
return 0;
}
unsigned int count = n->count;
for (int i = 0; i < n->count; i++) {
for (unsigned int i = 0; i < n->count; i++) {
if (ec && (ec->size > ec->idx)) {
ec->entries[ec->idx] = &n->entries[i];
ec->idx += 1;
@@ -434,7 +453,7 @@ exif_mnote_data_huawei_get_entry_by_tag_data (ExifMnoteDataHuawei *n, int *idx,
MnoteHuaweiEntry* entry = NULL;
if (!n) return NULL;
for (int i = 0; i < n->count; i++) {
for (unsigned int i = 0; i < n->count; i++) {
if (n->entries[i].tag == tag) {
entry = &n->entries[i];
break;
@@ -464,7 +483,7 @@ exif_mnote_data_huawei_get_entry_by_index_data (ExifMnoteDataHuawei *n, int *idx
MnoteHuaweiEntry* entry = NULL;
if (!n) return NULL;
for (int i = 0; i < n->count; i++) {
for (unsigned int i = 0; i < n->count; i++) {
if (*idx == dest_idx) {
entry = &n->entries[i];
break;
@@ -516,6 +535,7 @@ mnote_huawei_get_entry_count (const ExifMnoteDataHuawei* n, MnoteHuaweiEntryCoun
ec->size = count;
exif_mnote_data_huawei_count_data(ne, ec);
if (!entry_count) return;
*entry_count = ec;
}
@@ -660,7 +680,7 @@ exif_mnote_data_add_entry (ExifMnoteData *ne, MnoteHuaweiEntry *e)
goto Failed;
}
for(int i=0; i<ec->size; i++) {
for(unsigned int i=0; i<ec->size; i++) {
if(ec->entries[i]->tag == e->tag)
find_entry = ec->entries[i];
if(ec->entries[i]->tag == owner_tag)
@@ -732,6 +752,9 @@ exif_mnote_data_remove_entry (ExifMnoteData *ne, MnoteHuaweiEntry *e)
return;
}
memcpy (t, parent_md->entries, sizeof (MnoteHuaweiEntry) * (i));
if (parent_md->count-i < 1) {
return;
}
unsigned int tail_count = parent_md->count-i-1;
if (tail_count)
memcpy (&t[i], &parent_md->entries[i+1], sizeof (MnoteHuaweiEntry) * (tail_count));
@@ -752,7 +775,8 @@ exif_mnote_data_huawei_identify (const ExifData *ed, const ExifEntry *e)
{
int ret = 0;
if (!e && e->size < sizeof(HUAWEI_HEADER)) return ret;
if (!e || e->size < sizeof(HUAWEI_HEADER) || !e->data)
return ret;
ret = !memcmp(e->data, HUAWEI_HEADER, 8);
return ret;
@@ -805,10 +829,10 @@ memory_dump(const void *ptr, int len)
void
print_huawei_md(const ExifMnoteDataHuawei *n)
{
printf("ifd_tag: %04X, count:%d, ifd_pos:%p, ifd_size:%d\n", n->ifd_tag, n->count, n, n->ifd_size);
printf("ifd_tag: %04X, count:%u, ifd_size:%u\n", n->ifd_tag, n->count, n->ifd_size);
MnoteHuaweiEntry *entries = n->entries;
for (int i=0; i<n->count; i++) {
printf("idx:%d, tag: %04X, type: %d, components:%ld\n", i, entries[i].tag, entries[i].format, entries[i].components);
printf("idx:%d, tag: %04X, type: %d, components:%lu\n", i, entries[i].tag, entries[i].format, entries[i].components);
memory_dump(entries[i].data, entries[i].size);
if (entries[i].md) {
print_huawei_md((ExifMnoteDataHuawei*) entries[i].md);
libexif/huawei/mnote-huawei-entry.c
+13 -6
View File
@@ -27,6 +27,8 @@
#include <libexif/exif-utils.h>
#include <libexif/i18n.h>
#define DATA_LENGTH 1024
char *
mnote_huawei_entry_get_value(MnoteHuaweiEntry *e, char *v, unsigned int maxlen)
{
@@ -34,7 +36,7 @@ mnote_huawei_entry_get_value(MnoteHuaweiEntry *e, char *v, unsigned int maxlen)
return NULL;
memset(v, 0, maxlen);
int write_pos = 0;
unsigned int write_pos = 0;
ExifLong data = 0;
if (e->data == NULL) {
return NULL;
@@ -65,7 +67,7 @@ mnote_huawei_entry_get_value(MnoteHuaweiEntry *e, char *v, unsigned int maxlen)
if (e->format == EXIF_FORMAT_UNDEFINED) {
data = (e->data + i)[0];
} else if (e->format == EXIF_FORMAT_SLONG) {
data = exif_get_slong(e->data + i * 4, e->order);
data = (ExifLong)exif_get_slong(e->data + i * 4, e->order);
} else if (e->format == EXIF_FORMAT_LONG) {
data = exif_get_long(e->data + i * 4, e->order);
} else {
@@ -185,8 +187,9 @@ FINISH:
int
mnote_huawei_entry_set_value(MnoteHuaweiEntry *e, const char *v, int strlen)
{
char data[1024] = {0};
int increment = 0, components = 0, components_size = 0, ret = 0;
char data[DATA_LENGTH] = {0};
int increment = 0, ret = 0, components = 0;
unsigned int components_size = 0;
if (!e || !v || e->md) {
ret = -1;
@@ -218,7 +221,7 @@ mnote_huawei_entry_set_value(MnoteHuaweiEntry *e, const char *v, int strlen)
goto FINISH;
}
components_size = increment * components;
components_size = (unsigned int) (increment * components);
if (e->size < components_size) {
unsigned char *realloc = exif_mem_realloc(e->mem, e->data, components_size);
if (!realloc) {
@@ -229,7 +232,11 @@ mnote_huawei_entry_set_value(MnoteHuaweiEntry *e, const char *v, int strlen)
e->size = components_size;
}
e->components = components;
e->components = (unsigned long)components;
if (e->size < components_size || components_size > DATA_LENGTH) {
ret = -1;
goto FINISH;
}
memcpy(e->data, data, components_size);
FINISH: