Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
View | Details | Raw Unified | Return to bug 84076
Collapse All | Expand All

(-)libexif-0.5.12/libexif/exif-data.c.buffer-overflow (-1 / +7 lines)
Lines 551-557 Link Here
551
#endif
551
#endif
552
552
553
	/* Byte order (offset 6, length 2) */
553
	/* Byte order (offset 6, length 2) */
554
	if (size < 12)
554
	if (size < 14)
555
		return;
555
		return;
556
	if (!memcmp (d + 6, "II", 2))
556
	if (!memcmp (d + 6, "II", 2))
557
		data->priv->order = EXIF_BYTE_ORDER_INTEL;
557
		data->priv->order = EXIF_BYTE_ORDER_INTEL;
Lines 570-581 Link Here
570
	printf ("IFD 0 at %i.\n", (int) offset);
570
	printf ("IFD 0 at %i.\n", (int) offset);
571
#endif
571
#endif
572
572
573
	if (size < 6 + 4 + offset)
574
		return;
575
573
	/* Parse the actual exif data (offset 14) */
576
	/* Parse the actual exif data (offset 14) */
574
	exif_data_load_data_content (data, data->ifd[EXIF_IFD_0], d + 6,
577
	exif_data_load_data_content (data, data->ifd[EXIF_IFD_0], d + 6,
575
				     size - 6, offset);
578
				     size - 6, offset);
576
579
577
	/* IFD 1 offset */
580
	/* IFD 1 offset */
578
	n = exif_get_short (d + 6 + offset, data->priv->order);
581
	n = exif_get_short (d + 6 + offset, data->priv->order);
582
	if (size < 6 + offset + 2 + 12 * n + 4)
583
		return;
584
579
	offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
585
	offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
580
	if (offset) {
586
	if (offset) {
581
#ifdef DEBUG
587
#ifdef DEBUG

Return to bug 84076