Make sure the number of bytes being copied from doesn't exceed the
source buffer size.
From Android repo:
https://android.googlesource.com/platform/external/libexif/+/
0335ffc17f9b9a4831c242bb08ea92f605fde7a6%5E%21/#F0
Test: testPocBug_148705132
Bug:
148705132
fixes https://github.com/libexif/libexif/issues/42
/* Write the data. Fill unneeded bytes with 0. Do not crash with
* e->data is NULL */
if (e->data) {
- memcpy (*d + 6 + doff, e->data, s);
+ unsigned int len = s;
+ if (e->size < s) len = e->size;
+ memcpy (*d + 6 + doff, e->data, len);
} else {
memset (*d + 6 + doff, 0, s);
}