diff options
| author | Ray Essick <essick@google.com> | 2018-08-09 16:46:21 -0700 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2018-08-23 15:01:11 -0700 |
| commit | a5e8e5812a11ec9686294de8a5d68aaf2ab72475 (patch) | |
| tree | 4eb409d442d7c33445fc3a47a8634fdde27a2417 | |
| parent | 8f688823fc5399ab0f42ba2c8986cdd127dbde9b (diff) | |
| download | libexif-a5e8e5812a11ec9686294de8a5d68aaf2ab72475.tar.gz | |
Avoid 32-bit overflows on offset+size calculations
move to 64 bit math for several offset+size checks to avoid 32-bit overflows.
Exposed by enabling integer overflow detection 10 months ago; we finally
ran into a file that tripped the condition.
Bug: 112241654
Bug: 112537774
Test: manual
Change-Id: I027e87d9cd28e29ba21385543aaa3f1bc6f44b5b
| -rw-r--r-- | libexif/exif-data.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libexif/exif-data.c b/libexif/exif-data.c index 67df4db..adfb512 100644 --- a/libexif/exif-data.c +++ b/libexif/exif-data.c @@ -35,6 +35,7 @@ #include <libexif/olympus/exif-mnote-data-olympus.h> #include <libexif/pentax/exif-mnote-data-pentax.h> +#include <inttypes.h> #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -191,9 +192,12 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry, doff = offset + 8; /* Sanity checks */ - if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) { + int64_t doff64 = doff; + int64_t s64 = s; + if (doff64 + s64 > (int64_t) size) { exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "Tag data past end of buffer (%u > %u)", doff+s, size); + "Tag data past end of buffer (%" PRId64 " > %u)", + doff64+s64, size); return 0; } @@ -904,7 +908,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 0 at %i.", (int) offset); /* Sanity check the offset, being careful about overflow */ - if (offset > ds || offset + 6 + 2 > ds) + if (offset > ds || (uint64_t)offset + 6 + 2 > ds) return; /* Parse the actual exif data (usually offset 14 from start) */ @@ -912,7 +916,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, /* IFD 1 offset */ n = exif_get_short (d + 6 + offset, data->priv->order); - if (offset + 6 + 2 + 12 * n + 4 > ds) + if ((uint64_t)offset + 6 + 2 + 12 * n + 4 > ds) return; offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order); @@ -921,7 +925,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, "IFD 1 at %i.", (int) offset); /* Sanity check. */ - if (offset > ds || offset + 6 > ds) { + if (offset > ds || (uint64_t)offset + 6 > ds) { exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", "Bogus offset of IFD1."); } else { |