Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.3:Update
jhead.17742
jhead-CVE-2021-34055.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File jhead-CVE-2021-34055.patch of Package jhead.17742
diff --git a/exif.c b/exif.c index 1dee145..4d26a5f 100644 --- a/exif.c +++ b/exif.c @@ -978,7 +978,7 @@ static void ProcessExifDir(unsigned char * DirStart, unsigned char * OffsetBase, // Process a EXIF marker // Describes all the drivel that most digital cameras include... //-------------------------------------------------------------------------- -void process_EXIF (unsigned char * ExifSection, unsigned int length) +int process_EXIF (unsigned char * ExifSection, unsigned int length) { unsigned int FirstOffset; @@ -995,7 +995,7 @@ void process_EXIF (unsigned char * ExifSection, unsigned int length) static uchar ExifHeader[] = "Exif\0\0"; if (memcmp(ExifSection+2, ExifHeader,6)){ ErrNonfatal("Incorrect Exif header",0,0); - return; + return 0; } } @@ -1008,21 +1008,21 @@ void process_EXIF (unsigned char * ExifSection, unsigned int length) MotorolaOrder = 1; }else{ ErrNonfatal("Invalid Exif alignment marker.",0,0); - return; + return 0; } } // Check the next value for correctness. if (Get16u(ExifSection+10) != 0x2a){ ErrNonfatal("Invalid Exif start (1)",0,0); - return; + return 0; } FirstOffset = Get32u(ExifSection+12); if (FirstOffset < 8 || FirstOffset > 16){ if (FirstOffset < 16 || length < 16 || FirstOffset > length-16){ ErrNonfatal("invalid offset for first Exif IFD value",0,0); - return; + return 0; } // Usually set to 8, but other values valid too. ErrNonfatal("Suspicious offset of first Exif IFD value",0,0); @@ -1061,6 +1061,7 @@ void process_EXIF (unsigned char * ExifSection, unsigned int length) ImageInfo.FocalLength35mmEquiv = (int)(ImageInfo.FocalLength/ImageInfo.CCDWidth*36 + 0.5); } } + return 1; } @@ -1209,6 +1210,7 @@ void create_EXIF(void) const char * ClearOrientation(void) { int a; + if (NumOrientations == 0) return NULL; for (a=0;a<NumOrientations;a++){ diff --git a/jhead.h b/jhead.h index ce4125f..ce068bf 100644 --- a/jhead.h +++ b/jhead.h @@ -157,7 +157,7 @@ void FileTimeAsString(char * TimeStr); // Prototypes for exif.c functions. int Exif2tm(struct tm * timeptr, char * ExifTime); -void process_EXIF (unsigned char * CharBuf, unsigned int length); +int process_EXIF (unsigned char * CharBuf, unsigned int length); void ShowImageInfo(int ShowFileInfo); void ShowConciseImageInfo(void); const char * ClearOrientation(void); diff --git a/jpgfile.c b/jpgfile.c index beb2b19..598a317 100644 --- a/jpgfile.c +++ b/jpgfile.c @@ -284,7 +284,10 @@ int ReadJpegSections (FILE * infile, ReadMode_t ReadMode) // There can be different section using the same marker. if (ReadMode & READ_METADATA){ if (memcmp(Data+2, "Exif", 4) == 0){ - process_EXIF(Data, itemlen); + if (!process_EXIF(Data, itemlen)){ + // malformatted exif sections, discard. + free(Sections[--SectionsRead].Data); + } break; }else if (memcmp(Data+2, "http:", 5) == 0){ Sections[SectionsRead-1].Type = M_XMP; // Change tag for internal purposes.
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor