From ac4a9cd56f8145c0b1226fe977772a40e3a994a9 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sat, 2 Mar 2019 15:07:40 -0800 Subject: [PATCH] Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE Also fix for bug #77659 (cherry picked from commit 8ac6fee8562533a15db90062117210ed28b44fea) --- ext/exif/exif.c | 3 ++- ext/exif/tests/bug77563.jpg | Bin 0 -> 63 bytes ext/exif/tests/bug77563.phpt | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 ext/exif/tests/bug77563.jpg create mode 100644 ext/exif/tests/bug77563.phpt diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 5497068fb1..ce8db170c7 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2751,7 +2751,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu break; } - if (maker_note->offset >= value_len) { + if (value_len < 2 || maker_note->offset >= value_len - 1) { /* Do not go past the value end */ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset); return FALSE; @@ -2804,6 +2804,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu break; default: case MN_OFFSET_NORMAL: + data_len = value_len; break; }