diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2020-11-06 02:59:27 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-11-06 02:59:27 +0000 |
| commit | 9ec8c86860a4e5739f9f31ba38f5976abadd0546 (patch) | |
| tree | 2dc0c8fc86a4d7a276d17b56b752355d1b7f9d2b | |
| parent | f302d55d42e9df7adf5f5383ab5614389aae97d7 (diff) | |
| parent | 2769ec991318ad4b11fa276e672a6bb8f20418d9 (diff) | |
| download | libexif-android11-mainline-extservices-release.tar.gz | |
fixes some (not all) buffer overreads during decoding pentax makernote entries. am: 836cfdb99e am: 0a45dca22e am: 24bdc1361a am: 8e051e1ef6 am: 3dcd0f5c7e am: 514b69b2a6 am: 2769ec9913android-mainline-11.0.0_r44android-mainline-11.0.0_r23android-mainline-11.0.0_r15android11-mainline-os-statsd-releaseandroid11-mainline-extservices-release
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/libexif/+/12970376
Change-Id: I834992d149dbd745320d68aac036be6d807299b9
| -rw-r--r-- | libexif/pentax/mnote-pentax-entry.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c index 7e97c2c..dcb1560 100644 --- a/libexif/pentax/mnote-pentax-entry.c +++ b/libexif/pentax/mnote-pentax-entry.c @@ -425,24 +425,34 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, case EXIF_FORMAT_SHORT: { const unsigned char *data = entry->data; - size_t k, len = strlen(val); + size_t k, len = strlen(val), sizeleft; + + sizeleft = entry->size; for(k=0; k<entry->components; k++) { + if (sizeleft < 2) + break; vs = exif_get_short (data, entry->order); snprintf (val+len, maxlen-len, "%i ", vs); len = strlen(val); data += 2; + sizeleft -= 2; } } break; case EXIF_FORMAT_LONG: { const unsigned char *data = entry->data; - size_t k, len = strlen(val); + size_t k, len = strlen(val), sizeleft; + + sizeleft = entry->size; for(k=0; k<entry->components; k++) { + if (sizeleft < 4) + break; vl = exif_get_long (data, entry->order); snprintf (val+len, maxlen-len, "%li", (long int) vl); len = strlen(val); data += 4; + sizeleft -= 4; } } break; @@ -455,5 +465,5 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, break; } - return (val); + return val; } |