Fix 'start_pos' > 'end_pos' issue 21/310721/3 accepted/tizen/unified/20240508.124556 accepted/tizen/unified/20240508.150746 accepted/tizen/unified/x/20240509.044722
authorMinje Ahn <minje.ahn@samsung.com>
Tue, 7 May 2024 08:07:59 +0000 (17:07 +0900)
committerMinje Ahn <minje.ahn@samsung.com>
Wed, 8 May 2024 02:20:02 +0000 (11:20 +0900)
[cause]
The following string can be read from a PDF file with consecutive xmp metadata blocks:
  ... </x:xmpmeta><x:xmpmeta ...
In this case, 'end_pos' is less than 'start_pos'.

[solve]
Anything before 'start_pos' in the buffer is ignored.

Change-Id: I28d2669c1ecaf755501da64b903a23478c723ef2
Signed-off-by: Minje Ahn <minje.ahn@samsung.com>
packaging/libmedia-service.spec
src/media-svc-util.c

index 95598f6..15909c7 100644 (file)
@@ -1,6 +1,6 @@
 Name:       libmedia-service
 Summary:    Media information service library for multimedia applications
-Version:    0.6.3
+Version:    0.6.4
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0
index cc71a7e..70c956d 100644 (file)
@@ -862,10 +862,10 @@ static int __media_svc_get_epub_metadata(media_svc_content_info_s *content_info)
 static int __media_svc_get_pdf_metadata(media_svc_content_info_s *content_info)
 {
     int fd = 0;
-    int start_pos = 0;
-    int end_pos = 0;
-    int cur_pos = 0;
-    int search_limit = 0;
+    size_t start_pos = 0;
+    size_t end_pos = 0;
+    size_t cur_pos = 0;
+    size_t search_limit = 0;
     char tmp[MEDIA_SVC_PDF_BUF_SIZE + 1] = {0, };
     gchar *meta_buf = NULL;
     char *found = NULL;
@@ -896,8 +896,7 @@ static int __media_svc_get_pdf_metadata(media_svc_content_info_s *content_info)
                        found = NULL;
                }
 
-
-               if (start_pos != 0 && (found = strstr(tmp, "</x:xmpmeta>"))) {
+               if (start_pos > 0 && (found = strstr(tmp + ((cur_pos > start_pos) ? 0 : (start_pos - cur_pos)), "</x:xmpmeta>"))) {
                        end_pos = cur_pos + (found - tmp) + MEDIA_SVC_PDF_TAG_TAIL_LEN;
 //                     media_svc_error("FIND END_POS[%d]", end_pos);
                        found = NULL;