2009-03-21 Lutz Mueller <lutz@users.sourceforge.net>

	Meder Kydyraliev <meder.k@gmail.com> suggested to add some sanity
	checks:

	* libexif/exif-data.c (exif_data_load_entry),
	  (exif_data_load_data_thumbnail)
	* libexif/canon/exif_mnote-data-canon.c
          (exif_mnote_data_canon_load)
	* libexif/fuji/exif-mnote-data-fuji.c
	  (exif_mnote_data_fuji_load)
	* libexif/olympus/exif-mnote-data-olympus.c
          (exif_mnote_data_olympus_load)
	* libexif/pentax/exif-mnote-data-pentax.c
	  (exif_mnote_data_pentax_load)

diff --git a/ChangeLog b/ChangeLog
index 6710cc9..2e33855 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,19 @@
+2009-03-21  Lutz Mueller <lutz@users.sourceforge.net>
+
+       Meder Kydyraliev <meder.k@gmail.com> suggested to add some sanity
+       checks:
+
+       * libexif/exif-data.c (exif_data_load_entry),
+         (exif_data_load_data_thumbnail)
+       * libexif/canon/exif_mnote-data-canon.c
+          (exif_mnote_data_canon_load)
+       * libexif/fuji/exif-mnote-data-fuji.c
+         (exif_mnote_data_fuji_load)
+       * libexif/olympus/exif-mnote-data-olympus.c
+          (exif_mnote_data_olympus_load)
+       * libexif/pentax/exif-mnote-data-pentax.c
+         (exif_mnote_data_pentax_load)
+
 2009-03-16  Lutz Mueller <lutz@users.sourceforge.net>
 
        * libexif/canon/exif-mnote-data-canon.c:

diff --git a/libexif/canon/exif-mnote-data-canon.c b/libexif/canon/exif-mnote-data-canon.c
index f23aeb8..6a6999e 100644 (file)
--- a/libexif/canon/exif-mnote-data-canon.c
+++ b/libexif/canon/exif-mnote-data-canon.c
@@ -241,7 +241,7 @@ exif_mnote_data_canon_load (ExifMnoteData *ne,
                }
                o += 8;
                if (s > 4) o = exif_get_long (buf + o, n->order) + 6;
-               if (o + s > buf_size) {
+               if ((o + s < s) || (o + s < o) || (o + s > buf_size)) {
                        exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
                                "ExifMnoteCanon",
                                "Tag data past end of buffer (%u > %u)",

diff --git a/libexif/exif-data.c b/libexif/exif-data.c
index e267f34..0029c39 100644 (file)
--- a/libexif/exif-data.c
+++ b/libexif/exif-data.c
@@ -196,9 +196,7 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry,
                doff = offset + 8;
 
        /* Sanity checks */
-       if ((doff + s < doff) || (doff + s < s))
-               return 0;
-       if (size < doff + s)
+       if ((doff + s < doff) || (doff + s < s) || (doff + s > size))
                return 0;
 
        entry->data = exif_data_alloc (data, s);
@@ -309,21 +307,24 @@ exif_data_save_data_entry (ExifData *data, ExifEntry *e,
 
 static void
 exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
-                              unsigned int ds, ExifLong offset, ExifLong size)
+                              unsigned int ds, ExifLong o, ExifLong s)
 {
-       if ((ds < offset + size) || (offset > ds)) {
+       /* Sanity checks */
+       if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) {
                exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
                          "Bogus thumbnail offset (%u) or size (%u).",
-                         offset, size);
+                         o, s);
                return;
        }
+
        if (data->data) 
                exif_mem_free (data->priv->mem, data->data);
-       data->size = size;
-       data->data = exif_data_alloc (data, data->size);
-       if (!data->data) 
+       if (!(data->data = exif_data_alloc (data, s))) {
+               data->size = 0;
                return;
-       memcpy (data->data, d + offset, data->size);
+       }
+       data->size = s;
+       memcpy (data->data, d + o, s);
 }
 
 #undef CHECK_REC

diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
index 9a5677c..0e346e2 100644 (file)
--- a/libexif/fuji/exif-mnote-data-fuji.c
+++ b/libexif/fuji/exif-mnote-data-fuji.c
@@ -155,11 +155,15 @@ exif_mnote_data_fuji_load (ExifMnoteData *en,
        size_t i, o, s, datao = 6 + n->offset;
        MnoteFujiEntry *t;
 
-       if (!n || !buf || !buf_size || (buf_size < datao + 12)) return;
+       if (!n || !buf || !buf_size || (datao + 12 < datao) ||
+           (datao + 12 < 12) || (datao + 12 > buf_size))
+               return;
 
        /* Read the number of entries and remove old ones. */
        n->order = EXIF_BYTE_ORDER_INTEL;
        datao += exif_get_long (buf + datao + 8, EXIF_BYTE_ORDER_INTEL);
+       if ((datao + 2 < datao) || (datao + 2 < 2))
+               return;
        c = exif_get_short (buf + datao, EXIF_BYTE_ORDER_INTEL);
        datao += 2;
        exif_mnote_data_fuji_clear (n);
@@ -192,10 +196,10 @@ exif_mnote_data_fuji_load (ExifMnoteData *en,
                if (!s) return;
                o += 8;
                if (s > 4) o = exif_get_long (buf + o, n->order) + 6 + n->offset;
-               if (o + s > buf_size) {
-                       exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji",
-                                         "Tag data past end of buffer (%u > %u)",
-                                         o+s, buf_size);
+               if ((o + s < o) || (o + s < s) || (o + s > buf_size)) {
+                       exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                                 "ExifMnoteDataFuji", "Tag data past end of "
+                                 "buffer (%u > %u)", o + s, buf_size);
                        return;
                }
 

diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
index dbe9a0c..874ef98 100644 (file)
--- a/libexif/olympus/exif-mnote-data-olympus.c
+++ b/libexif/olympus/exif-mnote-data-olympus.c
@@ -380,7 +380,7 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
        /* Parse all c entries, storing ones that are successfully parsed */
        for (i = c, tcount = 0, o = o2; i; --i, o += 12) {
                size_t dataofs;
-           if (o + 12 > buf_size) {
+           if ((o + 12 < o) || (o + 12 < 12) || (o + 12 > buf_size)) {
                        exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
                                  "ExifMnoteOlympus", "Short MakerNote");
                        break;
@@ -427,11 +427,12 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
                            }
 #endif
                        }
-                       if (dataofs + s > buf_size)  {
+                       if ((dataofs + s < dataofs) || (dataofs + s < s) || 
+                           (dataofs + s > buf_size)) {
                                exif_log (en->log, EXIF_LOG_CODE_DEBUG,
                                          "ExifMnoteOlympus",
                                          "Tag data past end of buffer (%u > %u)",
-                                         dataofs+s, buf_size);
+                                         dataofs + s, buf_size);
                                continue;
                        }
 

diff --git a/libexif/pentax/exif-mnote-data-pentax.c b/libexif/pentax/exif-mnote-data-pentax.c
index b9a9c8c..20d5710 100644 (file)
--- a/libexif/pentax/exif-mnote-data-pentax.c
+++ b/libexif/pentax/exif-mnote-data-pentax.c
@@ -139,10 +139,10 @@ exif_mnote_data_pentax_load (ExifMnoteData *en,
                if (!s) return;
                o += 8;
                if (s > 4) o = exif_get_long (buf + o, n->order) + 6;
-               if (o + s > buf_size) {
-                       exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax",
-                                         "Tag data past end of buffer (%u > %u)",
-                                         o+s, buf_size);
+               if ((o + s < o) || (o + s < s) || (o + s > buf_size)) {
+                       exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                                 "ExifMnoteDataPentax", "Tag data past end "
+                                 "of buffer (%u > %u)", o + s, buf_size);
                        return;
                }