fix cve bugs

Signed-off-by: lifumin <lifumin3@h-partners.com>

libexif/apple/mnote-apple-entry.c

@@ -43,6 +43,9 @@ mnote_apple_entry_get_value(MnoteAppleEntry *entry, char *v, unsigned int maxlen
 
     if (!entry)
         return NULL;
+    if (maxlen < 1) {
+		return NULL;
+	}
 
     memset(v, 0, maxlen);
     maxlen--;

libexif/canon/mnote-canon-entry.c

@@ -561,6 +561,9 @@ mnote_canon_entry_get_value (const MnoteCanonEntry *entry, unsigned int t, char
 
 	if (!entry) 
 		return NULL;
+	if (maxlen < 1) {
+    return NULL;
+  }
 
 	data = entry->data;
 	size = entry->size;

libexif/fuji/exif-mnote-data-fuji.c

@@ -70,7 +70,9 @@ exif_mnote_data_fuji_get_value (ExifMnoteData *d, unsigned int i, char *val, uns
 	ExifMnoteDataFuji *n = (ExifMnoteDataFuji *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) {
+		return NULL;
+	}
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji",
 		  "Querying value for tag '%s'...",

libexif/fuji/mnote-fuji-entry.c

@@ -201,6 +201,9 @@ mnote_fuji_entry_get_value (MnoteFujiEntry *entry,
 	int i, j;
 
 	if (!entry) return (NULL);
+	if (maxlen < 1) {
+    return NULL;
+  }
 
 	memset (val, 0, maxlen);
 	maxlen--;

libexif/olympus/exif-mnote-data-olympus.c

@@ -78,7 +78,9 @@ exif_mnote_data_olympus_get_value (ExifMnoteData *d, unsigned int i, char *val,
 	ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) {
+		return NULL;
+	}
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus",
 		  "Querying value for tag '%s'...",
@@ -386,6 +388,9 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
 		o2 += 2;
 
 		/* Go to where the number of entries is. */
+		if (CHECKOVERFLOW(o2,buf_size,exif_get_long (buf + o2, n->order))) {
+			return;
+		}
 		o2 = datao + exif_get_long (buf + o2, n->order);
 		break;
 

libexif/olympus/mnote-olympus-entry.c

@@ -286,6 +286,9 @@ mnote_olympus_entry_get_value (MnoteOlympusEntry *entry, char *v, unsigned int m
 
 	if (!entry)
 		return (NULL);
+	if (maxlen < 1) {
+		return NULL;
+	}
 
 	memset (v, 0, maxlen);
 	maxlen--;

libexif/pentax/mnote-pentax-entry.c

@@ -317,6 +317,9 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
 	int i = 0, j = 0;
 
 	if (!entry) return (NULL);
+	if (maxlen < 1) {
+    return (NULL);
+  }
 
 	memset (val, 0, maxlen);
 	maxlen--;