/* exif-data.c
*
- * Copyright © 2001 Lutz Müller <lutz@users.sourceforge.net>
+ * Copyright (c) 2001 Lutz Mueller <lutz@users.sourceforge.net>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
*/
#include <config.h>
-#include "exif-mnote-data.h"
-
-#include "exif-data.h"
-#include "exif-ifd.h"
-#include "exif-mnote-data-priv.h"
-#include "exif-utils.h"
-#include "exif-loader.h"
-#include "jpeg-marker.h"
+
+#include <libexif/exif-mnote-data.h>
+#include <libexif/exif-data.h>
+#include <libexif/exif-ifd.h>
+#include <libexif/exif-mnote-data-priv.h>
+#include <libexif/exif-utils.h>
+#include <libexif/exif-loader.h>
#include <libexif/exif-log.h>
+#include <libexif/i18n.h>
+#include <libexif/exif-system.h>
-#include <libexif/olympus/exif-mnote-data-olympus.h>
#include <libexif/canon/exif-mnote-data-canon.h>
+#include <libexif/fuji/exif-mnote-data-fuji.h>
+#include <libexif/olympus/exif-mnote-data-olympus.h>
#include <libexif/pentax/exif-mnote-data-pentax.h>
+#include <math.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
-#undef MAX
-#define MAX(a, b) (((a) > (b)) ? (a) : (b))
-
-#if defined(__WATCOMC__) || defined(_MSC_VER)
-# define strncasecmp strnicmp
-#endif
+#undef JPEG_MARKER_SOI
+#define JPEG_MARKER_SOI 0xd8
+#undef JPEG_MARKER_APP0
+#define JPEG_MARKER_APP0 0xe0
+#undef JPEG_MARKER_APP1
+#define JPEG_MARKER_APP1 0xe1
static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
/* Temporarily used while loading data */
unsigned int offset_mnote;
+
+ ExifDataOption options;
+ ExifDataType data_type;
};
static void *
{
void *d;
- if (!data || !i) return NULL;
+ if (!data || !i)
+ return NULL;
d = exif_mem_alloc (data->priv->mem, i);
- if (d) return d;
+ if (d)
+ return d;
EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", i);
return NULL;
ExifData *data;
unsigned int i;
- if (!mem) return NULL;
+ if (!mem)
+ return NULL;
data = exif_mem_alloc (mem, sizeof (ExifData));
- if (!data) return (NULL);
+ if (!data)
+ return (NULL);
data->priv = exif_mem_alloc (mem, sizeof (ExifDataPrivate));
- if (!data->priv) { exif_mem_free (mem, data); return (NULL); }
+ if (!data->priv) {
+ exif_mem_free (mem, data);
+ return (NULL);
+ }
data->priv->ref_count = 1;
data->priv->mem = mem;
data->ifd[i]->parent = data;
}
+ /* Default options */
+#ifndef NO_VERBOSE_TAG_STRINGS
+ /*
+ * When the tag list is compiled away, setting this option prevents
+ * any tags from being loaded
+ */
+ exif_data_set_option (data, EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS);
+#endif
+ exif_data_set_option (data, EXIF_DATA_OPTION_FOLLOW_SPECIFICATION);
+
+ /* Default data type: none */
+ exif_data_set_data_type (data, EXIF_DATA_TYPE_COUNT);
+
return (data);
}
return (edata);
}
-static void
+static int
exif_data_load_data_entry (ExifData *data, ExifEntry *entry,
const unsigned char *d,
unsigned int size, unsigned int offset)
entry->format = exif_get_short (d + offset + 2, data->priv->order);
entry->components = exif_get_long (d + offset + 4, data->priv->order);
+ /* FIXME: should use exif_tag_get_name_in_ifd here but entry->parent
+ * has not been set yet
+ */
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"Loading entry 0x%x ('%s')...", entry->tag,
exif_tag_get_name (entry->tag));
+ /* {0,1,2,4,8} x { 0x00000000 .. 0xffffffff }
+ * -> { 0x000000000 .. 0x7fffffff8 } */
+ s = exif_format_get_size(entry->format) * entry->components;
+ if ((s < entry->components) || (s == 0)){
+ return 0;
+ }
+
/*
* Size? If bigger than 4 bytes, the actual data is not
* in the entry but somewhere else (offset).
*/
- s = exif_format_get_size (entry->format) * entry->components;
- if (!s)
- return;
if (s > 4)
doff = exif_get_long (d + offset + 8, data->priv->order);
else
doff = offset + 8;
- /* Sanity check */
- if (size < doff + s)
- return;
+ /* Sanity checks */
+ if (doff >= size) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "Tag starts past end of buffer (%u > %u)", doff, size);
+ return 0;
+ }
+
+ if (s > size - doff) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "Tag data goes past end of buffer (%u > %u)", doff+s, size);
+ return 0;
+ }
entry->data = exif_data_alloc (data, s);
if (entry->data) {
entry->size = s;
memcpy (entry->data, d + doff, s);
+ } else {
+ EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", s);
+ return 0;
}
-#ifndef EXIF_DONT_CHANGE_MAKER_NOTE
/* If this is the MakerNote, remember the offset */
if (entry->tag == EXIF_TAG_MAKER_NOTE) {
- if (entry->size > 6) exif_log (data->priv->log,
- EXIF_LOG_CODE_DEBUG, "ExifData",
- "MakerNote found (%02x %02x %02x %02x "
- "%02x %02x %02x...).",
- entry->data[0], entry->data[1], entry->data[2],
- entry->data[3], entry->data[4], entry->data[5],
- entry->data[6]);
+ if (!entry->data) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "MakerNote found with empty data");
+ } else if (entry->size > 6) {
+ exif_log (data->priv->log,
+ EXIF_LOG_CODE_DEBUG, "ExifData",
+ "MakerNote found (%02x %02x %02x %02x "
+ "%02x %02x %02x...).",
+ entry->data[0], entry->data[1], entry->data[2],
+ entry->data[3], entry->data[4], entry->data[5],
+ entry->data[6]);
+ }
data->priv->offset_mnote = doff;
}
-#endif
-
- exif_entry_fix (entry);
+ return 1;
}
static void
unsigned int offset)
{
unsigned int doff, s;
+ unsigned int ts;
- if (!data || !data->priv) return;
+ if (!data || !data->priv)
+ return;
/*
* Each entry is 12 bytes long. The memory for the entry has
exif_set_short (*d + 6 + offset + 2,
data->priv->order, (ExifShort) e->format);
- /* If this is the maker note tag, update it. */
- if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
- exif_mem_free (data->priv->mem, e->data);
- e->data = NULL;
- e->size = 0;
- exif_mnote_data_set_offset (data->priv->md, *ds - 6);
- exif_mnote_data_save (data->priv->md, &e->data, &e->size);
- e->components = e->size;
+ if (!(data->priv->options & EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE)) {
+ /* If this is the maker note tag, update it. */
+ if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
+ /* TODO: this is using the wrong ExifMem to free e->data */
+ exif_mem_free (data->priv->mem, e->data);
+ e->data = NULL;
+ e->size = 0;
+ exif_mnote_data_set_offset (data->priv->md, *ds - 6);
+ exif_mnote_data_save (data->priv->md, &e->data, &e->size);
+ e->components = e->size;
+ if (exif_format_get_size (e->format) != 1) {
+ /* e->format is taken from input code,
+ * but we need to make sure it is a 1 byte
+ * entity due to the multiplication below. */
+ e->format = EXIF_FORMAT_UNDEFINED;
+ }
+ }
}
exif_set_long (*d + 6 + offset + 4,
*/
s = exif_format_get_size (e->format) * e->components;
if (s > 4) {
+ unsigned char *t;
doff = *ds - 6;
- *ds += s;
- *d = exif_mem_realloc (data->priv->mem, *d, *ds);
- if (!*d) {
- EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", *ds);
+ ts = *ds + s;
+
+ /*
+ * According to the TIFF specification,
+ * the offset must be an even number. If we need to introduce
+ * a padding byte, we set it to 0.
+ */
+ if (s & 1)
+ ts++;
+ t = exif_mem_realloc (data->priv->mem, *d, ts);
+ if (!t) {
+ EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
return;
}
- exif_set_long (*d + 6 + offset + 8,
- data->priv->order, doff);
+ *d = t;
+ *ds = ts;
+ exif_set_long (*d + 6 + offset + 8, data->priv->order, doff);
+ if (s & 1)
+ *(*d + *ds - 1) = '\0';
+
} else
doff = offset + 8;
- /* Write the data. Fill unneeded bytes with 0. */
- memcpy (*d + 6 + doff, e->data, s);
- if (s < 4) memset (*d + 6 + doff + s, 0, (4 - s));
+ /* Write the data. Fill unneeded bytes with 0. Do not crash with
+ * e->data is NULL */
+ if (e->data) {
+ unsigned int len = s;
+ if (e->size < s) len = e->size;
+ memcpy (*d + 6 + doff, e->data, len);
+ } else {
+ memset (*d + 6 + doff, 0, s);
+ }
+ if (s < 4)
+ memset (*d + 6 + doff + s, 0, (4 - s));
}
static void
exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
- unsigned int ds, ExifLong offset, ExifLong size)
+ unsigned int ds, ExifLong o, ExifLong s)
{
- if (ds < offset + size) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Bogus thumbnail offset and size: %i < %i + %i.",
- (int) ds, (int) offset, (int) size);
+ /* Sanity checks */
+ if (o >= ds) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
+ return;
+ }
+ if (s > ds - o) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
return;
}
- if (data->data) exif_mem_free (data->priv->mem, data->data);
- data->size = size;
- data->data = exif_data_alloc (data, data->size);
- if (!data->data) return;
- memcpy (data->data, d + offset, data->size);
+ if (data->data)
+ exif_mem_free (data->priv->mem, data->data);
+ if (!(data->data = exif_data_alloc (data, s))) {
+ EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", s);
+ data->size = 0;
+ return;
+ }
+ data->size = s;
+ memcpy (data->data, d + o, s);
}
#undef CHECK_REC
#define CHECK_REC(i) \
-if (data->ifd[(i)] == ifd) { \
+if ((i) == ifd) { \
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, \
"ExifData", "Recursive entry in IFD " \
"'%s' detected. Skipping...", \
exif_ifd_get_name (i)); \
break; \
+} \
+if (data->ifd[(i)]->count) { \
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, \
+ "ExifData", "Attempt to load IFD " \
+ "'%s' multiple times detected. " \
+ "Skipping...", \
+ exif_ifd_get_name (i)); \
+ break; \
}
+/*! Calculate the recursion cost added by one level of IFD loading.
+ *
+ * The work performed is related to the cost in the exponential relation
+ * work=1.1**cost
+ */
+static unsigned int
+level_cost(unsigned int n)
+{
+ static const double log_1_1 = 0.09531017980432493;
+
+ /* Adding 0.1 protects against the case where n==1 */
+ return ceil(log(n + 0.1)/log_1_1);
+}
+
+/*! Load data for an IFD.
+ *
+ * \param[in,out] data #ExifData
+ * \param[in] ifd IFD to load
+ * \param[in] d pointer to buffer containing raw IFD data
+ * \param[in] ds size of raw data in buffer at \c d
+ * \param[in] offset offset into buffer at \c d at which IFD starts
+ * \param[in] recursion_cost factor indicating how expensive this recursive
+ * call could be
+ */
static void
-exif_data_load_data_content (ExifData *data, ExifContent *ifd,
+exif_data_load_data_content (ExifData *data, ExifIfd ifd,
const unsigned char *d,
- unsigned int ds, unsigned int offset)
+ unsigned int ds, unsigned int offset, unsigned int recursion_cost)
{
ExifLong o, thumbnail_offset = 0, thumbnail_length = 0;
ExifShort n;
unsigned int i;
ExifTag tag;
- if (!data || !data->priv) return;
+ if (!data || !data->priv)
+ return;
+
+ /* check for valid ExifIfd enum range */
+ if ((((int)ifd) < 0) || ( ((int)ifd) >= EXIF_IFD_COUNT))
+ return;
+
+ if (recursion_cost > 170) {
+ /*
+ * recursion_cost is a logarithmic-scale indicator of how expensive this
+ * recursive call might end up being. It is an indicator of the depth of
+ * recursion as well as the potential for worst-case future recursive
+ * calls. Since it's difficult to tell ahead of time how often recursion
+ * will occur, this assumes the worst by assuming every tag could end up
+ * causing recursion.
+ * The value of 170 was chosen to limit typical EXIF structures to a
+ * recursive depth of about 6, but pathological ones (those with very
+ * many tags) to only 2.
+ */
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+ "Deep/expensive recursion detected!");
+ return;
+ }
/* Read the number of entries */
- if (offset >= ds - 1) return;
+ if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+ "Tag data past end of buffer (%u > %u)", offset+2, ds);
+ return;
+ }
n = exif_get_short (d + offset, data->priv->order);
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Loading %i entries...", n);
+ "Loading %hu entries...", n);
offset += 2;
/* Check if we have enough data. */
- if (offset + 12 * n > ds) n = (ds - offset) / 12;
+ if (offset + 12 * n > ds) {
+ n = (ds - offset) / 12;
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "Short data; only loading %hu entries...", n);
+ }
for (i = 0; i < n; i++) {
case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
o = exif_get_long (d + offset + 12 * i + 8,
data->priv->order);
+ if (o >= ds) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+ "Tag data past end of buffer (%u > %u)", offset+2, ds);
+ return;
+ }
+ /* FIXME: IFD_POINTER tags aren't marked as being in a
+ * specific IFD, so exif_tag_get_name_in_ifd won't work
+ */
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "Sub-IFD entry 0x%x ('%s') at %u.", tag,
+ exif_tag_get_name(tag), o);
switch (tag) {
case EXIF_TAG_EXIF_IFD_POINTER:
CHECK_REC (EXIF_IFD_EXIF);
- exif_data_load_data_content (data,
- data->ifd[EXIF_IFD_EXIF], d, ds, o);
+ exif_data_load_data_content (data, EXIF_IFD_EXIF, d, ds, o,
+ recursion_cost + level_cost(n));
break;
case EXIF_TAG_GPS_INFO_IFD_POINTER:
CHECK_REC (EXIF_IFD_GPS);
- exif_data_load_data_content (data,
- data->ifd[EXIF_IFD_GPS], d, ds, o);
+ exif_data_load_data_content (data, EXIF_IFD_GPS, d, ds, o,
+ recursion_cost + level_cost(n));
break;
case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
CHECK_REC (EXIF_IFD_INTEROPERABILITY);
- exif_data_load_data_content (data,
- data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds, o);
+ exif_data_load_data_content (data, EXIF_IFD_INTEROPERABILITY, d, ds, o,
+ recursion_cost + level_cost(n));
break;
case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
thumbnail_offset = o;
if (thumbnail_offset && thumbnail_length)
exif_data_load_data_thumbnail (data, d,
- ds, thumbnail_offset,
- thumbnail_length);
+ ds, thumbnail_offset,
+ thumbnail_length);
break;
case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH:
thumbnail_length = o;
if (thumbnail_offset && thumbnail_length)
exif_data_load_data_thumbnail (data, d,
- ds, thumbnail_offset,
- thumbnail_length);
+ ds, thumbnail_offset,
+ thumbnail_length);
break;
default:
return;
default:
/*
- * If we don't know the tag, changes are high
- * that the EXIF data does not follow the standard.
+ * If we don't know the tag, don't fail. It could be that new
+ * versions of the standard have defined additional tags. Note that
+ * 0 is a valid tag in the GPS IFD.
*/
- if (!exif_tag_get_name (tag)) {
+ if (!exif_tag_get_name_in_ifd (tag, ifd)) {
+
+ /*
+ * Special case: Tag and format 0. That's against specification
+ * (at least up to 2.2). But Photoshop writes it anyways.
+ */
+ if (!memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ "Skipping empty entry at position %u in '%s'.", i,
+ exif_ifd_get_name (ifd));
+ break;
+ }
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Unknown tag %x (entry %i)", tag, i);
- return;
+ "Unknown tag 0x%04x (entry %u in '%s'). Please report this tag "
+ "to <libexif-devel@lists.sourceforge.net>.", tag, i,
+ exif_ifd_get_name (ifd));
+ if (data->priv->options & EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS)
+ break;
}
entry = exif_entry_new_mem (data->priv->mem);
- exif_content_add_entry (ifd, entry);
- exif_data_load_data_entry (data, entry, d, ds,
- offset + 12 * i);
+ if (!entry) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_NO_MEMORY, "ExifData",
+ "Could not allocate memory");
+ return;
+ }
+ if (exif_data_load_data_entry (data, entry, d, ds,
+ offset + 12 * i))
+ exif_content_add_entry (data->ifd[ifd], entry);
exif_entry_unref (entry);
break;
}
}
}
+static int
+cmp_func (const unsigned char *p1, const unsigned char *p2, ExifByteOrder o)
+{
+ ExifShort tag1 = exif_get_short (p1, o);
+ ExifShort tag2 = exif_get_short (p2, o);
+
+ return (tag1 < tag2) ? -1 : (tag1 > tag2) ? 1 : 0;
+}
+
+static int
+cmp_func_intel (const void *elem1, const void *elem2)
+{
+ return cmp_func ((const unsigned char *) elem1,
+ (const unsigned char *) elem2, EXIF_BYTE_ORDER_INTEL);
+}
+
+static int
+cmp_func_motorola (const void *elem1, const void *elem2)
+{
+ return cmp_func ((const unsigned char *) elem1,
+ (const unsigned char *) elem2, EXIF_BYTE_ORDER_MOTOROLA);
+}
+
static void
exif_data_save_data_content (ExifData *data, ExifContent *ifd,
unsigned char **d, unsigned int *ds,
{
unsigned int j, n_ptr = 0, n_thumb = 0;
ExifIfd i;
+ unsigned char *t;
+ unsigned int ts;
- if (!data || !data->priv || !ifd || !d || !ds) return;
+ if (!data || !data->priv || !ifd || !d || !ds)
+ return;
for (i = 0; i < EXIF_IFD_COUNT; i++)
if (ifd == data->ifd[i])
break;
if (i == EXIF_IFD_COUNT)
- return;
+ return; /* error */
/*
* Check if we need some extra entries for pointers or the thumbnail.
* Allocate enough memory for all entries
* and the number of entries.
*/
- *ds += (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
- *d = exif_mem_realloc (data->priv->mem, *d, *ds);
- if (!*d) {
- EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", *ds);
+ ts = *ds + (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
+ t = exif_mem_realloc (data->priv->mem, *d, ts);
+ if (!t) {
+ EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
return;
}
+ *d = t;
+ *ds = ts;
/* Save the number of entries */
exif_set_short (*d + 6 + offset, data->priv->order,
(ExifShort) (ifd->count + n_ptr + n_thumb));
offset += 2;
- /* Save each entry */
+ /*
+ * Save each entry. Make sure that no memcpys from NULL pointers are
+ * performed
+ */
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"Saving %i entries (IFD '%s', offset: %i)...",
ifd->count, exif_ifd_get_name (i), offset);
- for (j = 0; j < ifd->count; j++)
- exif_data_save_data_entry (data, ifd->entries[j],
- d, ds, offset + 12 * j);
+ for (j = 0; j < ifd->count; j++) {
+ if (ifd->entries[j]) {
+ exif_data_save_data_entry (data, ifd->entries[j], d, ds,
+ offset + 12 * j);
+ }
+ }
+
offset += 12 * ifd->count;
/* Now save special entries. */
exif_set_long (*d + 6 + offset + 8, data->priv->order,
*ds - 6);
exif_data_save_data_content (data,
- data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6);
+ data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6);
offset += 12;
}
exif_set_long (*d + 6 + offset + 8, data->priv->order,
*ds - 6);
exif_data_save_data_content (data,
- data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6);
+ data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6);
offset += 12;
}
exif_set_long (*d + 6 + offset + 8, data->priv->order,
*ds - 6);
exif_data_save_data_content (data,
- data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
- *ds - 6);
+ data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
+ *ds - 6);
offset += 12;
}
1);
exif_set_long (*d + 6 + offset + 8, data->priv->order,
*ds - 6);
- *ds += data->size;
- *d = exif_mem_realloc (data->priv->mem, *d, *ds);
- if (!*d) {
+ ts = *ds + data->size;
+ t = exif_mem_realloc (data->priv->mem, *d, ts);
+ if (!t) {
EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData",
- *ds);
+ ts);
return;
}
+ *d = t;
+ *ds = ts;
memcpy (*d + *ds - data->size, data->data, data->size);
offset += 12;
/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH */
exif_set_short (*d + 6 + offset + 0, data->priv->order,
- EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
+ EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
exif_set_short (*d + 6 + offset + 2, data->priv->order,
EXIF_FORMAT_LONG);
exif_set_long (*d + 6 + offset + 4, data->priv->order,
break;
}
+ /* Sort the directory according to TIFF specification */
+ qsort (*d + 6 + offset - (ifd->count + n_ptr + n_thumb) * 12,
+ (ifd->count + n_ptr + n_thumb), 12,
+ (data->priv->order == EXIF_BYTE_ORDER_INTEL) ? cmp_func_intel : cmp_func_motorola);
+
/* Correctly terminate the directory */
if (i == EXIF_IFD_0 && (data->ifd[EXIF_IFD_1]->count ||
- data->size)) {
+ data->size)) {
/*
* We are saving IFD 0. Tell where IFD 1 starts and save
exif_set_long (*d + 6 + offset, data->priv->order, 0);
}
+typedef enum {
+ EXIF_DATA_TYPE_MAKER_NOTE_NONE = 0,
+ EXIF_DATA_TYPE_MAKER_NOTE_CANON = 1,
+ EXIF_DATA_TYPE_MAKER_NOTE_OLYMPUS = 2,
+ EXIF_DATA_TYPE_MAKER_NOTE_PENTAX = 3,
+ EXIF_DATA_TYPE_MAKER_NOTE_NIKON = 4,
+ EXIF_DATA_TYPE_MAKER_NOTE_CASIO = 5,
+ EXIF_DATA_TYPE_MAKER_NOTE_FUJI = 6
+} ExifDataTypeMakerNote;
+
+/*! If MakerNote is recognized, load it.
+ *
+ * \param[in,out] data #ExifData
+ * \param[in] d pointer to raw EXIF data
+ * \param[in] ds length of data at d
+ */
+static void
+interpret_maker_note(ExifData *data, const unsigned char *d, unsigned int ds)
+{
+ int mnoteid;
+ ExifEntry* e = exif_data_get_entry (data, EXIF_TAG_MAKER_NOTE);
+ if (!e)
+ return;
+
+ if ((mnoteid = exif_mnote_data_olympus_identify (data, e)) != 0) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
+ "ExifData", "Olympus MakerNote variant type %d", mnoteid);
+ data->priv->md = exif_mnote_data_olympus_new (data->priv->mem);
+
+ } else if ((mnoteid = exif_mnote_data_canon_identify (data, e)) != 0) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
+ "ExifData", "Canon MakerNote variant type %d", mnoteid);
+ data->priv->md = exif_mnote_data_canon_new (data->priv->mem, data->priv->options);
+
+ } else if ((mnoteid = exif_mnote_data_fuji_identify (data, e)) != 0) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
+ "ExifData", "Fuji MakerNote variant type %d", mnoteid);
+ data->priv->md = exif_mnote_data_fuji_new (data->priv->mem);
+
+ /* NOTE: Must do Pentax detection last because some of the
+ * heuristics are pretty general. */
+ } else if ((mnoteid = exif_mnote_data_pentax_identify (data, e)) != 0) {
+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
+ "ExifData", "Pentax MakerNote variant type %d", mnoteid);
+ data->priv->md = exif_mnote_data_pentax_new (data->priv->mem);
+ }
+
+ /*
+ * If we are able to interpret the maker note, do so.
+ */
+ if (data->priv->md) {
+ exif_mnote_data_log (data->priv->md, data->priv->log);
+ exif_mnote_data_set_byte_order (data->priv->md,
+ data->priv->order);
+ exif_mnote_data_set_offset (data->priv->md,
+ data->priv->offset_mnote);
+ exif_mnote_data_load (data->priv->md, d, ds);
+ }
+}
+
+#define LOG_TOO_SMALL \
+exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", \
+ _("Size of data too small to allow for EXIF data."));
+
void
exif_data_load_data (ExifData *data, const unsigned char *d_orig,
- unsigned int ds_orig)
+ unsigned int ds)
{
unsigned int l;
ExifLong offset;
ExifShort n;
- ExifEntry *e, *em;
const unsigned char *d = d_orig;
- unsigned int ds = ds_orig, len;
+ unsigned int len, fullds;
- if (!data || !data->priv || !d || !ds) return;
+ if (!data || !data->priv || !d || !ds)
+ return;
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"Parsing %i byte(s) EXIF data...\n", ds);
* not, search the EXIF marker.
*/
if (ds < 6) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Size too small.");
+ LOG_TOO_SMALL;
return;
}
if (!memcmp (d, ExifHeader, 6)) {
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Found EXIF header.");
+ "Found EXIF header at start.");
} else {
- while (1) {
- while ((d[0] == 0xff) && ds) {
+ while (ds >= 3) {
+ while (ds && (d[0] == 0xff)) {
d++;
ds--;
}
/* JPEG_MARKER_SOI */
- if (d[0] == JPEG_MARKER_SOI) {
+ if (ds && d[0] == JPEG_MARKER_SOI) {
d++;
ds--;
continue;
}
- /* JPEG_MARKER_APP0 */
- if (d[0] == JPEG_MARKER_APP0) {
+ /* JPEG_MARKER_APP1 */
+ if (ds && d[0] == JPEG_MARKER_APP1)
+ break;
+
+ /* Skip irrelevant APP markers. The branch for APP1 must come before this,
+ otherwise this code block will cause APP1 to be skipped. This code path
+ is only relevant for files that are nonconformant to the EXIF
+ specification. For conformant files, the APP1 code path above will be
+ taken. */
+ if (ds >= 3 && d[0] >= 0xe0 && d[0] <= 0xef) { /* JPEG_MARKER_APPn */
d++;
ds--;
l = (d[0] << 8) | d[1];
continue;
}
- /* JPEG_MARKER_APP1 */
- if (d[0] == JPEG_MARKER_APP1)
- break;
-
/* Unknown marker or data. Give up. */
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
- "ExifData", "EXIF marker not found.");
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
+ "ExifData", _("EXIF marker not found."));
return;
}
- d++;
- ds--;
- if (ds < 2) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
- "ExifData", "Size too small.");
+ if (ds < 3) {
+ LOG_TOO_SMALL;
return;
}
+ d++;
+ ds--;
len = (d[0] << 8) | d[1];
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"We have to deal with %i byte(s) of EXIF data.",
* (offset 2, length 6).
*/
if (ds < 6) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "Size too small.");
+ LOG_TOO_SMALL;
return;
}
if (memcmp (d, ExifHeader, 6)) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
- "EXIF header not found.");
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
+ "ExifData", _("EXIF header not found."));
return;
}
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"Found EXIF header.");
- /* Byte order (offset 6, length 2) */
- if (ds < 12)
+ /* Sanity check the data length */
+ if (ds < 14)
return;
+
+ /* The JPEG APP1 section can be no longer than 64 KiB (including a
+ 16-bit length), so cap the data length to protect against overflow
+ in future offset calculations */
+ fullds = ds;
+ if (ds > 0xfffe)
+ ds = 0xfffe;
+
+ /* Byte order (offset 6, length 2) */
if (!memcmp (d + 6, "II", 2))
data->priv->order = EXIF_BYTE_ORDER_INTEL;
else if (!memcmp (d + 6, "MM", 2))
data->priv->order = EXIF_BYTE_ORDER_MOTOROLA;
- else
+ else {
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
+ "ExifData", _("Unknown encoding."));
return;
+ }
/* Fixed value */
if (exif_get_short (d + 8, data->priv->order) != 0x002a)
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"IFD 0 at %i.", (int) offset);
- /* Parse the actual exif data (offset 14) */
- exif_data_load_data_content (data, data->ifd[EXIF_IFD_0], d + 6,
- ds - 6, offset);
+ /* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
+ if (offset > ds || offset + 6 + 2 > ds)
+ return;
+
+ /* Parse the actual exif data (usually offset 14 from start) */
+ exif_data_load_data_content (data, EXIF_IFD_0, d + 6, ds - 6, offset, 0);
/* IFD 1 offset */
n = exif_get_short (d + 6 + offset, data->priv->order);
+ /* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
+ if (offset + 6 + 2 + 12 * n + 4 > ds)
+ return;
+
offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
if (offset) {
exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
"IFD 1 at %i.", (int) offset);
- /* Sanity check. */
+ /* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
if (offset > ds - 6) {
- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
- "ExifData", "Bogus offset!");
- return;
+ exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
+ "ExifData", "Bogus offset of IFD1.");
+ } else {
+ exif_data_load_data_content (data, EXIF_IFD_1, d + 6, ds - 6, offset, 0);
}
-
- exif_data_load_data_content (data, data->ifd[EXIF_IFD_1], d + 6,
- ds - 6, offset);
}
/*
* space between IFDs. Here is the only place where we have access
* to that data.
*/
- e = exif_data_get_entry (data, EXIF_TAG_MAKER_NOTE);
- if (e) {
-
- /* Olympus & Nikon */
- if ((e->size >= 5) && (!memcmp (e->data, "OLYMP", 5) ||
- !memcmp (e->data, "Nikon", 5))) {
- data->priv->md = exif_mnote_data_olympus_new (data->priv->mem);
- } else {
- char value[7];
- em = exif_data_get_entry (data, EXIF_TAG_MAKE);
- /* Pentax & some variant of Nikon */
- if ((e->size >= 2) && (e->data[0] == 0x00)
- && (e->data[1] == 0x1b)) {
- if (em && !strncasecmp (exif_entry_get_value (em, value, sizeof(value)), "Nikon", 5)) {
- data->priv->md = exif_mnote_data_olympus_new (data->priv->mem);
- } else {
- data->priv->md = exif_mnote_data_pentax_new (data->priv->mem);
- }
-
- } else {
- /* Canon */
- if (em) {
-
- if (!strcmp (exif_entry_get_value (em, value, sizeof(value)), "Canon"))
- data->priv->md = exif_mnote_data_canon_new (data->priv->mem);
- }
- }
- }
+ interpret_maker_note(data, d, fullds);
- /*
- * If we are able to interpret the maker note, do so.
- */
- if (data->priv->md) {
- exif_mnote_data_log (data->priv->md, data->priv->log);
- exif_mnote_data_set_byte_order (data->priv->md,
- data->priv->order);
- exif_mnote_data_set_offset (data->priv->md,
- data->priv->offset_mnote);
- exif_mnote_data_load (data->priv->md, d, ds);
- }
- }
+ /* Fixup tags if requested */
+ if (data->priv->options & EXIF_DATA_OPTION_FOLLOW_SPECIFICATION)
+ exif_data_fix (data);
}
void
exif_data_save_data (ExifData *data, unsigned char **d, unsigned int *ds)
{
+ if (ds)
+ *ds = 0; /* This means something went wrong */
+
if (!data || !d || !ds)
return;
/* Header */
*ds = 14;
*d = exif_data_alloc (data, *ds);
- if (!*d) return;
+ if (!*d) {
+ *ds = 0;
+ return;
+ }
memcpy (*d, ExifHeader, 6);
/* Order (offset 6) */
void
exif_data_unref (ExifData *data)
{
- if (!data)
+ if (!data)
return;
data->priv->ref_count--;
- if (!data->priv->ref_count)
+ if (!data->priv->ref_count)
exif_data_free (data);
}
unsigned int i;
ExifMem *mem = (data && data->priv) ? data->priv->mem : NULL;
- if (!data) return;
+ if (!data)
+ return;
for (i = 0; i < EXIF_IFD_COUNT; i++) {
if (data->ifd[i]) {
}
if (data->priv) {
+ if (data->priv->log) {
+ exif_log_unref (data->priv->log);
+ data->priv->log = NULL;
+ }
if (data->priv->md) {
exif_mnote_data_unref (data->priv->md);
data->priv->md = NULL;
}
if (data->data) {
- printf ("%i byte(s) thumbnail data available.", data->size);
+ printf ("%i byte(s) thumbnail data available: ", data->size);
if (data->size >= 4) {
printf ("0x%02x 0x%02x ... 0x%02x 0x%02x\n",
data->data[0], data->data[1],
entry_set_byte_order (ExifEntry *e, void *data)
{
ByteOrderChangeData *d = data;
- unsigned int i;
- ExifShort s;
- ExifLong l;
- ExifSLong sl;
- ExifRational r;
- ExifSRational sr;
if (!e)
return;
- switch (e->format) {
- case EXIF_FORMAT_SHORT:
- for (i = 0; i < e->components; i++) {
- s = exif_get_short (e->data +
- (i * exif_format_get_size (e->format)),
- d->old);
- exif_set_short (e->data +
- (i * exif_format_get_size (e->format)),
- d->new, s);
- }
- break;
- case EXIF_FORMAT_LONG:
- for (i = 0; i < e->components; i++) {
- l = exif_get_long (e->data +
- (i * exif_format_get_size (e->format)),
- d->old);
- exif_set_long (e->data +
- (i * exif_format_get_size (e->format)),
- d->new, l);
- }
- break;
- case EXIF_FORMAT_RATIONAL:
- for (i = 0; i < e->components; i++) {
- r = exif_get_rational (e->data +
- (i * exif_format_get_size (e->format)),
- d->old);
- exif_set_rational (e->data +
- (i * exif_format_get_size (e->format)),
- d->new, r);
- }
- break;
- case EXIF_FORMAT_SLONG:
- for (i = 0; i < e->components; i++) {
- sl = exif_get_slong (e->data +
- (i * exif_format_get_size (e->format)),
- d->old);
- exif_set_slong (e->data +
- (i * exif_format_get_size (e->format)),
- d->new, sl);
- }
- break;
- case EXIF_FORMAT_SRATIONAL:
- for (i = 0; i < e->components; i++) {
- sr = exif_get_srational (e->data +
- (i * exif_format_get_size (e->format)),
- d->old);
- exif_set_srational (e->data +
- (i * exif_format_get_size (e->format)),
- d->new, sr);
- }
- break;
- case EXIF_FORMAT_UNDEFINED:
- case EXIF_FORMAT_BYTE:
- case EXIF_FORMAT_SBYTE:
- case EXIF_FORMAT_ASCII:
- default:
- /* Nothing here. */
- break;
- }
+ exif_array_set_byte_order (e->format, e->data, e->components, d->old, d->new);
}
static void
void
exif_data_log (ExifData *data, ExifLog *log)
{
- if (!data || !data->priv) return;
+ unsigned int i;
+
+ if (!data || !data->priv)
+ return;
exif_log_unref (data->priv->log);
data->priv->log = log;
exif_log_ref (log);
+
+ for (i = 0; i < EXIF_IFD_COUNT; i++)
+ exif_content_log (data->ifd[i], log);
}
/* Used internally within libexif */
ExifLog *
exif_data_get_log (ExifData *data)
{
- if (!data || !data->priv) return NULL;
+ if (!data || !data->priv)
+ return NULL;
return data->priv->log;
}
+
+static const struct {
+ ExifDataOption option;
+ const char *name;
+ const char *description;
+} exif_data_option[] = {
+ {EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS, N_("Ignore unknown tags"),
+ N_("Ignore unknown tags when loading EXIF data.")},
+ {EXIF_DATA_OPTION_FOLLOW_SPECIFICATION, N_("Follow specification"),
+ N_("Add, correct and remove entries to get EXIF data that follows "
+ "the specification.")},
+ {EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE, N_("Do not change maker note"),
+ N_("When loading and resaving Exif data, save the maker note unmodified."
+ " Be aware that the maker note can get corrupted.")},
+ {0, NULL, NULL}
+};
+
+const char *
+exif_data_option_get_name (ExifDataOption o)
+{
+ unsigned int i;
+
+ for (i = 0; exif_data_option[i].name; i++)
+ if (exif_data_option[i].option == o)
+ break;
+ return _(exif_data_option[i].name);
+}
+
+const char *
+exif_data_option_get_description (ExifDataOption o)
+{
+ unsigned int i;
+
+ for (i = 0; exif_data_option[i].description; i++)
+ if (exif_data_option[i].option == o)
+ break;
+ return _(exif_data_option[i].description);
+}
+
+void
+exif_data_set_option (ExifData *d, ExifDataOption o)
+{
+ if (!d)
+ return;
+
+ d->priv->options |= o;
+}
+
+void
+exif_data_unset_option (ExifData *d, ExifDataOption o)
+{
+ if (!d)
+ return;
+
+ d->priv->options &= ~o;
+}
+
+static void
+fix_func (ExifContent *c, void *UNUSED(data))
+{
+ switch (exif_content_get_ifd (c)) {
+ case EXIF_IFD_1:
+ if (c->parent->data)
+ exif_content_fix (c);
+ else if (c->count) {
+ exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
+ "No thumbnail but entries on thumbnail. These entries have been "
+ "removed.");
+ while (c->count) {
+ unsigned int cnt = c->count;
+ exif_content_remove_entry (c, c->entries[c->count - 1]);
+ if (cnt == c->count) {
+ /* safety net */
+ exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
+ "failed to remove last entry from entries.");
+ c->count--;
+ }
+ }
+ }
+ break;
+ default:
+ exif_content_fix (c);
+ }
+}
+
+void
+exif_data_fix (ExifData *d)
+{
+ exif_data_foreach_content (d, fix_func, NULL);
+}
+
+void
+exif_data_set_data_type (ExifData *d, ExifDataType dt)
+{
+ if (!d || !d->priv)
+ return;
+
+ d->priv->data_type = dt;
+}
+
+ExifDataType
+exif_data_get_data_type (ExifData *d)
+{
+ return (d && d->priv) ? d->priv->data_type : EXIF_DATA_TYPE_UNKNOWN;
+}