81a4940d25
Fixes the following security issues: - CVE-2016-6328: A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data). - CVE-2017-7544: libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure. - CVE-2018-20030: An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources. - CVE-2019-9278: In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
66 lines
1.8 KiB
Diff
66 lines
1.8 KiB
Diff
From 41bd04234b104312f54d25822f68738ba8d7133d Mon Sep 17 00:00:00 2001
|
|
From: Marcus Meissner <marcus@jet.franken.de>
|
|
Date: Tue, 25 Jul 2017 23:44:44 +0200
|
|
Subject: [PATCH] fixes some (not all) buffer overreads during decoding pentax
|
|
makernote entries.
|
|
|
|
This should fix:
|
|
https://sourceforge.net/p/libexif/bugs/125/ CVE-2016-6328
|
|
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
libexif/pentax/mnote-pentax-entry.c | 16 +++++++++++++---
|
|
1 file changed, 13 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c
|
|
index d03d159..ea0429a 100644
|
|
--- a/libexif/pentax/mnote-pentax-entry.c
|
|
+++ b/libexif/pentax/mnote-pentax-entry.c
|
|
@@ -425,24 +425,34 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
|
|
case EXIF_FORMAT_SHORT:
|
|
{
|
|
const unsigned char *data = entry->data;
|
|
- size_t k, len = strlen(val);
|
|
+ size_t k, len = strlen(val), sizeleft;
|
|
+
|
|
+ sizeleft = entry->size;
|
|
for(k=0; k<entry->components; k++) {
|
|
+ if (sizeleft < 2)
|
|
+ break;
|
|
vs = exif_get_short (data, entry->order);
|
|
snprintf (val+len, maxlen-len, "%i ", vs);
|
|
len = strlen(val);
|
|
data += 2;
|
|
+ sizeleft -= 2;
|
|
}
|
|
}
|
|
break;
|
|
case EXIF_FORMAT_LONG:
|
|
{
|
|
const unsigned char *data = entry->data;
|
|
- size_t k, len = strlen(val);
|
|
+ size_t k, len = strlen(val), sizeleft;
|
|
+
|
|
+ sizeleft = entry->size;
|
|
for(k=0; k<entry->components; k++) {
|
|
+ if (sizeleft < 4)
|
|
+ break;
|
|
vl = exif_get_long (data, entry->order);
|
|
snprintf (val+len, maxlen-len, "%li", (long int) vl);
|
|
len = strlen(val);
|
|
data += 4;
|
|
+ sizeleft -= 4;
|
|
}
|
|
}
|
|
break;
|
|
@@ -455,5 +465,5 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
|
|
break;
|
|
}
|
|
|
|
- return (val);
|
|
+ return val;
|
|
}
|
|
--
|
|
2.20.1
|
|
|