diff options
author | Xin Li <delphij@google.com> | 2019-07-01 20:59:30 +0000 |
---|---|---|
committer | Xin Li <delphij@google.com> | 2019-07-01 20:59:30 +0000 |
commit | abf98cb75298ded2f2dd4e63448a69668c733f99 (patch) | |
tree | 7f39495551c65a37f40b23544dee1cbc221feebf | |
parent | 6e549f527cd1f0521040e85f25832d5db0af5713 (diff) | |
parent | 1a6756b78ad1c7fca57cb8521081fc01181e8f83 (diff) | |
download | libexif-temp_140451723.tar.gz |
DO NOT MERGE - Merge qt-dev-plus-aosp-without-vendor (5699924) into stage-aosp-mastertemp_140451723
Bug: 134405016
Change-Id: I17822cdefacbf60c243723eac774bb56ce4f4ae1
-rw-r--r-- | libexif/exif-data.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libexif/exif-data.c b/libexif/exif-data.c index 67df4db..adfb512 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -35,6 +35,7 @@ #include <libexif/olympus/exif-mnote-data-olympus.h> #include <libexif/pentax/exif-mnote-data-pentax.h> +#include <inttypes.h> #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -191,9 +192,12 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry, doff = offset + 8; /* Sanity checks */ - if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) { + int64_t doff64 = doff; + int64_t s64 = s; + if (doff64 + s64 > (int64_t) size) { exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "Tag data past end of buffer (%u > %u)", doff+s, size); + "Tag data past end of buffer (%" PRId64 " > %u)", + doff64+s64, size); return 0; } @@ -904,7 +908,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 0 at %i.", (int) offset); /* Sanity check the offset, being careful about overflow */ - if (offset > ds || offset + 6 + 2 > ds) + if (offset > ds || (uint64_t)offset + 6 + 2 > ds) return; /* Parse the actual exif data (usually offset 14 from start) */ @@ -912,7 +916,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, /* IFD 1 offset */ n = exif_get_short (d + 6 + offset, data->priv->order); - if (offset + 6 + 2 + 12 * n + 4 > ds) + if ((uint64_t)offset + 6 + 2 + 12 * n + 4 > ds) return; offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order); @@ -921,7 +925,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 1 at %i.", (int) offset); /* Sanity check. */ - if (offset > ds || offset + 6 > ds) { + if (offset > ds || (uint64_t)offset + 6 > ds) { exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", "Bogus offset of IFD1."); } else { |