diff options
| author | Xin Li <delphij@google.com> | 2019-09-04 13:33:44 -0700 |
|---|---|---|
| committer | Xin Li <delphij@google.com> | 2019-09-04 13:33:44 -0700 |
| commit | f38b0acde804da1aa6e3c6130561c9628d2ff0cd (patch) | |
| tree | 7f39495551c65a37f40b23544dee1cbc221feebf | |
| parent | 6e549f527cd1f0521040e85f25832d5db0af5713 (diff) | |
| parent | abf98cb75298ded2f2dd4e63448a69668c733f99 (diff) | |
| download | libexif-ndk-sysroot-r21.tar.gz | |
DO NOT MERGE - Merge Android 10 into masterndk-sysroot-r21
Bug: 139893257
Change-Id: I63f18bc50793010bd872d7e4b5df7ff66a56c07a
| -rw-r--r-- | libexif/exif-data.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libexif/exif-data.c b/libexif/exif-data.c index 67df4db..adfb512 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -35,6 +35,7 @@ #include <libexif/olympus/exif-mnote-data-olympus.h> #include <libexif/pentax/exif-mnote-data-pentax.h> +#include <inttypes.h> #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -191,9 +192,12 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry, doff = offset + 8; /* Sanity checks */ - if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) { + int64_t doff64 = doff; + int64_t s64 = s; + if (doff64 + s64 > (int64_t) size) { exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "Tag data past end of buffer (%u > %u)", doff+s, size); + "Tag data past end of buffer (%" PRId64 " > %u)", + doff64+s64, size); return 0; } @@ -904,7 +908,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 0 at %i.", (int) offset); /* Sanity check the offset, being careful about overflow */ - if (offset > ds || offset + 6 + 2 > ds) + if (offset > ds || (uint64_t)offset + 6 + 2 > ds) return; /* Parse the actual exif data (usually offset 14 from start) */ @@ -912,7 +916,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, /* IFD 1 offset */ n = exif_get_short (d + 6 + offset, data->priv->order); - if (offset + 6 + 2 + 12 * n + 4 > ds) + if ((uint64_t)offset + 6 + 2 + 12 * n + 4 > ds) return; offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order); @@ -921,7 +925,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 1 at %i.", (int) offset); /* Sanity check. */ - if (offset > ds || offset + 6 > ds) { + if (offset > ds || (uint64_t)offset + 6 > ds) { exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", "Bogus offset of IFD1."); } else { |