From 498ac4188a638f4eebb142be0e7b6ee92cded3b6 Mon Sep 17 00:00:00 2001
From: trafficPC167 <572304676@qq.com>
Date: Tue, 21 Apr 2026 14:33:36 +0800
Subject: [PATCH] fix cve bugs

Signed-off-by: lifumin <lifumin3@h-partners.com>
---
 libexif/apple/mnote-apple-entry.c         | 3 +++
 libexif/canon/mnote-canon-entry.c         | 3 +++
 libexif/fuji/exif-mnote-data-fuji.c       | 4 +++-
 libexif/fuji/mnote-fuji-entry.c           | 3 +++
 libexif/olympus/exif-mnote-data-olympus.c | 7 ++++++-
 libexif/olympus/mnote-olympus-entry.c     | 3 +++
 libexif/pentax/mnote-pentax-entry.c       | 3 +++
 7 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/libexif/apple/mnote-apple-entry.c b/libexif/apple/mnote-apple-entry.c
index 6740d8e..1eb2f0e 100644
--- a/libexif/apple/mnote-apple-entry.c
+++ b/libexif/apple/mnote-apple-entry.c
@@ -43,6 +43,9 @@ mnote_apple_entry_get_value(MnoteAppleEntry *entry, char *v, unsigned int maxlen
 
     if (!entry)
         return NULL;
+    if (maxlen < 1) {
+		return NULL;
+	}
 
     memset(v, 0, maxlen);
     maxlen--;
diff --git a/libexif/canon/mnote-canon-entry.c b/libexif/canon/mnote-canon-entry.c
index de0fac4..ac4b457 100644
--- a/libexif/canon/mnote-canon-entry.c
+++ b/libexif/canon/mnote-canon-entry.c
@@ -561,6 +561,9 @@ mnote_canon_entry_get_value (const MnoteCanonEntry *entry, unsigned int t, char
 
 	if (!entry) 
 		return NULL;
+	if (maxlen < 1) {
+    return NULL;
+  }
 
 	data = entry->data;
 	size = entry->size;
diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
index c28c541..5b4635f 100644
--- a/libexif/fuji/exif-mnote-data-fuji.c
+++ b/libexif/fuji/exif-mnote-data-fuji.c
@@ -70,7 +70,9 @@ exif_mnote_data_fuji_get_value (ExifMnoteData *d, unsigned int i, char *val, uns
 	ExifMnoteDataFuji *n = (ExifMnoteDataFuji *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) {
+		return NULL;
+	}
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji",
 		  "Querying value for tag '%s'...",
diff --git a/libexif/fuji/mnote-fuji-entry.c b/libexif/fuji/mnote-fuji-entry.c
index 47e01ed..a4c63d5 100644
--- a/libexif/fuji/mnote-fuji-entry.c
+++ b/libexif/fuji/mnote-fuji-entry.c
@@ -201,6 +201,9 @@ mnote_fuji_entry_get_value (MnoteFujiEntry *entry,
 	int i, j;
 
 	if (!entry) return (NULL);
+	if (maxlen < 1) {
+    return NULL;
+  }
 
 	memset (val, 0, maxlen);
 	maxlen--;
diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
index a57af17..0d70aec 100644
--- a/libexif/olympus/exif-mnote-data-olympus.c
+++ b/libexif/olympus/exif-mnote-data-olympus.c
@@ -78,7 +78,9 @@ exif_mnote_data_olympus_get_value (ExifMnoteData *d, unsigned int i, char *val,
 	ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) {
+		return NULL;
+	}
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus",
 		  "Querying value for tag '%s'...",
@@ -386,6 +388,9 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
 		o2 += 2;
 
 		/* Go to where the number of entries is. */
+		if (CHECKOVERFLOW(o2,buf_size,exif_get_long (buf + o2, n->order))) {
+			return;
+		}
 		o2 = datao + exif_get_long (buf + o2, n->order);
 		break;
 
diff --git a/libexif/olympus/mnote-olympus-entry.c b/libexif/olympus/mnote-olympus-entry.c
index e5200be..276e455 100644
--- a/libexif/olympus/mnote-olympus-entry.c
+++ b/libexif/olympus/mnote-olympus-entry.c
@@ -286,6 +286,9 @@ mnote_olympus_entry_get_value (MnoteOlympusEntry *entry, char *v, unsigned int m
 
 	if (!entry)
 		return (NULL);
+	if (maxlen < 1) {
+		return NULL;
+	}
 
 	memset (v, 0, maxlen);
 	maxlen--;
diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c
index 46900c3..1db31c3 100644
--- a/libexif/pentax/mnote-pentax-entry.c
+++ b/libexif/pentax/mnote-pentax-entry.c
@@ -317,6 +317,9 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
 	int i = 0, j = 0;
 
 	if (!entry) return (NULL);
+	if (maxlen < 1) {
+    return (NULL);
+  }
 
 	memset (val, 0, maxlen);
 	maxlen--;