Jan Patera's keen eyes noticed that my MakerNote unification changes

introduced a case where a NULL pointer would be dereferenced before
being checked for NULL.

diff --git a/libexif/canon/exif-mnote-data-canon.c b/libexif/canon/exif-mnote-data-canon.c
index b26d075..13dccfc 100644 (file)
--- a/libexif/canon/exif-mnote-data-canon.c
+++ b/libexif/canon/exif-mnote-data-canon.c
@@ -201,10 +201,15 @@ exif_mnote_data_canon_load (ExifMnoteData *ne,
 {
        ExifMnoteDataCanon *n = (ExifMnoteDataCanon *) ne;
        ExifShort c;
-       size_t i, tcount, o, datao = 6 + n->offset;
+       size_t i, tcount, o, datao;
 
-       if (!n || !buf || !buf_size || (datao + 2 < datao) ||
-           (datao + 2 < 2) || (datao + 2 > buf_size)) {
+       if (!n || !buf || !buf_size) {
+               exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                         "ExifMnoteCanon", "Short MakerNote");
+               return;
+       }
+       datao = 6 + n->offset;
+       if ((datao + 2 < datao) || (datao + 2 < 2) || (datao + 2 > buf_size)) {
                exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
                          "ExifMnoteCanon", "Short MakerNote");
                return;

diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
index 9f0a23b..0351eca 100644 (file)
--- a/libexif/fuji/exif-mnote-data-fuji.c
+++ b/libexif/fuji/exif-mnote-data-fuji.c
@@ -152,10 +152,15 @@ exif_mnote_data_fuji_load (ExifMnoteData *en,
 {
        ExifMnoteDataFuji *n = (ExifMnoteDataFuji*) en;
        ExifLong c;
-       size_t i, tcount, o, datao = 6 + n->offset;
+       size_t i, tcount, o, datao;
 
-       if (!n || !buf || !buf_size || (datao + 12 < datao) ||
-           (datao + 12 < 12) || (datao + 12 > buf_size)) {
+       if (!n || !buf || !buf_size) {
+               exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                         "ExifMnoteDataFuji", "Short MakerNote");
+               return;
+       }
+       datao = 6 + n->offset;
+       if ((datao + 12 < datao) || (datao + 12 < 12) || (datao + 12 > buf_size)) {
                exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
                          "ExifMnoteDataFuji", "Short MakerNote");
                return;

diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
index a954f31..b4fa39e 100644 (file)
--- a/libexif/olympus/exif-mnote-data-olympus.c
+++ b/libexif/olympus/exif-mnote-data-olympus.c
@@ -228,11 +228,15 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
 {
        ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) en;
        ExifShort c;
-       size_t i, tcount, o, o2 = 6 + n->offset, /* Start of interesting data */
-              datao = 6, base = 0;
+       size_t i, tcount, o, o2, datao = 6, base = 0;
 
-       if (!n || !buf || !buf_size || (n->offset + 22 < n->offset) ||
-           (n->offset + 22 < 22) || (n->offset + 22 > buf_size)) {
+       if (!n || !buf || !buf_size) {
+               exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                         "ExifMnoteDataOlympus", "Short MakerNote");
+               return;
+       }
+       o2 = 6 + n->offset; /* Start of interesting data */
+       if ((o2 + 10 < o2) || (o2 + 10 < 10) || (o2 + 10 > buf_size)) {
                exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
                          "ExifMnoteDataOlympus", "Short MakerNote");
                return;

diff --git a/libexif/pentax/exif-mnote-data-pentax.c b/libexif/pentax/exif-mnote-data-pentax.c
index e755ee9..c55894b 100644 (file)
--- a/libexif/pentax/exif-mnote-data-pentax.c
+++ b/libexif/pentax/exif-mnote-data-pentax.c
@@ -215,17 +215,22 @@ exif_mnote_data_pentax_load (ExifMnoteData *en,
                const unsigned char *buf, unsigned int buf_size)
 {
        ExifMnoteDataPentax *n = (ExifMnoteDataPentax *) en;
-       size_t i, tcount, o, datao = 6 + n->offset, base = 0;
+       size_t i, tcount, o, datao, base = 0;
        ExifShort c;
 
-       if (!n || !buf || !buf_size || (datao + 8 < datao) ||
-           (datao + 8 < 8) || (datao + 8 > buf_size)) {
+       if (!n || !buf || !buf_size) {
+               exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
+                         "ExifMnoteDataPentax", "Short MakerNote");
+               return;
+       }
+       datao = 6 + n->offset;
+       if ((datao + 8 < datao) || (datao + 8 < 8) || (datao + 8 > buf_size)) {
                exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
                          "ExifMnoteDataPentax", "Short MakerNote");
                return;
        }
 
-       /* Detect varient of Pentax/Casio MakerNote found */
+       /* Detect variant of Pentax/Casio MakerNote found */
        if (!memcmp(buf + datao, "AOC", 4)) {
                if ((buf[datao + 4] == 'I') && (buf[datao + 5] == 'I')) {
                        n->version = pentaxV3;