From bc279f31a1be2d3221bf164cb33589bc889561ba Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Wed, 25 Aug 2021 13:14:37 +0200 Subject: [PATCH] add boundary checks for RATIONAL and SRATIONAL generic output (oss-fuzz) --- libexif/apple/mnote-apple-entry.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libexif/apple/mnote-apple-entry.c b/libexif/apple/mnote-apple-entry.c index e24eda8..6740d8e 100644 --- a/libexif/apple/mnote-apple-entry.c +++ b/libexif/apple/mnote-apple-entry.c @@ -132,12 +132,16 @@ mnote_apple_entry_get_value(MnoteAppleEntry *entry, char *v, unsigned int maxlen } break; case EXIF_FORMAT_RATIONAL: + if (size < exif_format_get_size (EXIF_FORMAT_RATIONAL)) return NULL; + if (entry->components < 1) return NULL; /* FIXME: could handle more than 1 too */ vr = exif_get_rational (data, entry->order); if (!vr.denominator) break; snprintf (v, maxlen, "%2.4f", (double) vr.numerator / vr.denominator); break; case EXIF_FORMAT_SRATIONAL: + if (size < exif_format_get_size (EXIF_FORMAT_SRATIONAL)) return NULL; + if (entry->components < 1) return NULL; /* FIXME: could handle more than 1 too */ vsr = exif_get_srational (data, entry->order); if (!vsr.denominator) break; snprintf (v, maxlen, "%2.4f", (double) vsr.numerator /