1From 22ea582c6b74ada30bec3a6b15de3c3e52f2b4da Mon Sep 17 00:00:00 2001 2From: Robin Mills <robin@clanmills.com> 3Date: Mon, 5 Apr 2021 20:33:25 +0100 4Subject: [PATCH] fix_1522_jp2image_exif_asan 5 6--- 7 src/jp2image.cpp | 9 ++++++--- 8 1 file changed, 6 insertions(+), 3 deletions(-) 9 10diff --git a/src/jp2image.cpp b/src/jp2image.cpp 11index eb31cea4a..88ab9b2d6 100644 12--- a/src/jp2image.cpp 13+++ b/src/jp2image.cpp 14@@ -28,6 +28,7 @@ 15 #include "image.hpp" 16 #include "image_int.hpp" 17 #include "basicio.hpp" 18+#include "enforce.hpp" 19 #include "error.hpp" 20 #include "futils.hpp" 21 #include "types.hpp" 22@@ -353,7 +354,7 @@ static void boxes_check(size_t b,size_t m) 23 if (io_->error()) throw Error(kerFailedToReadImageData); 24 if (bufRead != rawData.size_) throw Error(kerInputDataReadFailed); 25 26- if (rawData.size_ > 0) 27+ if (rawData.size_ > 8) // "II*\0long" 28 { 29 // Find the position of Exif header in bytes array. 30 long pos = ( (rawData.pData_[0] == rawData.pData_[1]) 31@@ -497,6 +498,7 @@ static void boxes_check(size_t b,size_t m) 32 position = io_->tell(); 33 box.length = getLong((byte*)&box.length, bigEndian); 34 box.type = getLong((byte*)&box.type, bigEndian); 35+ enforce(box.length <= io_->size()-io_->tell() , Exiv2::kerCorruptedMetadata); 36 37 if (bPrint) { 38 out << Internal::stringFormat("%8ld | %8ld | ", (size_t)(position - sizeof(box)), 39@@ -581,12 +583,13 @@ static void boxes_check(size_t b,size_t m) 40 throw Error(kerInputDataReadFailed); 41 42 if (bPrint) { 43- out << Internal::binaryToString(makeSlice(rawData, 0, 40)); 44+ out << Internal::binaryToString( 45+ makeSlice(rawData, 0, rawData.size_>40?40:rawData.size_)); 46 out.flush(); 47 } 48 lf(out, bLF); 49 50- if (bIsExif && bRecursive && rawData.size_ > 0) { 51+ if (bIsExif && bRecursive && rawData.size_ > 8) { // "II*\0long" 52 if ((rawData.pData_[0] == rawData.pData_[1]) && 53 (rawData.pData_[0] == 'I' || rawData.pData_[0] == 'M')) { 54 BasicIo::AutoPtr p = BasicIo::AutoPtr(new MemIo(rawData.pData_, rawData.size_)); 55