Blame SOURCES/exiv2-additional-security-fixes.patch

3f58c5
diff --git a/src/actions.cpp b/src/actions.cpp
3f58c5
index 0ebe850..3cd398e 100644
3f58c5
--- a/src/actions.cpp
3f58c5
+++ b/src/actions.cpp
3f58c5
@@ -59,6 +59,7 @@ EXIV2_RCSID("@(#) $Id$")
3f58c5
 #include <ctime>
3f58c5
 #include <cmath>
3f58c5
 #include <cassert>
3f58c5
+#include <stdexcept>
3f58c5
 #include <sys/types.h>                  // for stat()
3f58c5
 #include <sys/stat.h>                   // for stat()
3f58c5
 #ifdef EXV_HAVE_UNISTD_H
3f58c5
@@ -236,33 +237,43 @@ namespace Action {
3f58c5
     }
3f58c5
3f58c5
     int Print::run(const std::string& path)
3f58c5
-    try {
3f58c5
-        path_ = path;
3f58c5
-        int rc = 0;
3f58c5
-        Exiv2::PrintStructureOption option = Exiv2::kpsNone ;
3f58c5
-        switch (Params::instance().printMode_) {
3f58c5
-            case Params::pmSummary:   rc = printSummary();     break;
3f58c5
-            case Params::pmList:      rc = printList();        break;
3f58c5
-            case Params::pmComment:   rc = printComment();     break;
3f58c5
-            case Params::pmPreview:   rc = printPreviewList(); break;
3f58c5
-            case Params::pmStructure: rc = printStructure(std::cout,Exiv2::kpsBasic)     ; break;
3f58c5
-            case Params::pmRecursive: rc = printStructure(std::cout,Exiv2::kpsRecursive) ; break;
3f58c5
-
3f58c5
-            case Params::pmXMP:
3f58c5
-                 option = option == Exiv2::kpsNone ? Exiv2::kpsXMP        : option;  // drop
3f58c5
-            case Params::pmIccProfile:{
3f58c5
-                 option = option == Exiv2::kpsNone ? Exiv2::kpsIccProfile : option;
3f58c5
-                 _setmode(_fileno(stdout),O_BINARY);
3f58c5
-                 rc = printStructure(std::cout,option);
3f58c5
-            } break;
3f58c5
+    {
3f58c5
+        try {
3f58c5
+            path_ = path;
3f58c5
+            int rc = 0;
3f58c5
+            Exiv2::PrintStructureOption option = Exiv2::kpsNone ;
3f58c5
+            switch (Params::instance().printMode_) {
3f58c5
+                case Params::pmSummary:   rc = printSummary();     break;
3f58c5
+                case Params::pmList:      rc = printList();        break;
3f58c5
+                case Params::pmComment:   rc = printComment();     break;
3f58c5
+                case Params::pmPreview:   rc = printPreviewList(); break;
3f58c5
+                case Params::pmStructure: rc = printStructure(std::cout,Exiv2::kpsBasic)     ; break;
3f58c5
+                case Params::pmRecursive: rc = printStructure(std::cout,Exiv2::kpsRecursive) ; break;
3f58c5
+
3f58c5
+                case Params::pmXMP:
3f58c5
+                    if (option == Exiv2::kpsNone)
3f58c5
+                        option = Exiv2::kpsXMP;
3f58c5
+                    // drop
3f58c5
+                case Params::pmIccProfile:
3f58c5
+                    if (option == Exiv2::kpsNone)
3f58c5
+                        option = Exiv2::kpsIccProfile;
3f58c5
+                    _setmode(_fileno(stdout),O_BINARY);
3f58c5
+                    rc = printStructure(std::cout,option);
3f58c5
+                    break;
3f58c5
+            }
3f58c5
+            return rc;
3f58c5
         }
3f58c5
-        return rc;
3f58c5
-    }
3f58c5
-    catch(const Exiv2::AnyError& e) {
3f58c5
-        std::cerr << "Exiv2 exception in print action for file "
3f58c5
-                  << path << ":\n" << e << "\n";
3f58c5
-        return 1;
3f58c5
-    } // Print::run
3f58c5
+        catch(const Exiv2::AnyError& e) {
3f58c5
+            std::cerr << "Exiv2 exception in print action for file "
3f58c5
+                      << path << ":\n" << e << "\n";
3f58c5
+            return 1;
3f58c5
+        }
3f58c5
+        catch(const std::overflow_error& e) {
3f58c5
+            std::cerr << "std::overflow_error exception in print action for file "
3f58c5
+                      << path << ":\n" << e.what() << "\n";
3f58c5
+            return 1;
3f58c5
+        }
3f58c5
+    }
3f58c5
3f58c5
     int Print::printStructure(std::ostream& out, Exiv2::PrintStructureOption option)
3f58c5
     {
3f58c5
diff --git a/src/error.cpp b/src/error.cpp
3f58c5
index e90a9c0..5d63957 100644
3f58c5
--- a/src/error.cpp
3f58c5
+++ b/src/error.cpp
3f58c5
@@ -109,6 +109,8 @@ namespace {
3f58c5
         { 55, N_("tiff directory length is too large") },
3f58c5
         { 56, N_("invalid type value detected in Image::printIFDStructure") },
3f58c5
         { 57, N_("invalid memory allocation request") },
3f58c5
+        { 58, N_("corrupted image metadata") },
3f58c5
+        { 59, N_("Arithmetic operation overflow") },
3f58c5
     };
3f58c5
3f58c5
 }
3f58c5
diff --git a/src/nikonmn.cpp b/src/nikonmn.cpp
3f58c5
index 571ab80..34bf601 100644
3f58c5
--- a/src/nikonmn.cpp
3f58c5
+++ b/src/nikonmn.cpp
3f58c5
@@ -299,6 +299,8 @@ namespace Exiv2 {
3f58c5
                                                const Value& value,
3f58c5
                                                const ExifData* exifData)
3f58c5
     {
3f58c5
+        if ( ! exifData ) return os << "undefined" ;
3f58c5
+
3f58c5
         if ( value.count() >= 9 ) {
3f58c5
             ByteOrder bo = getKeyString("Exif.MakerNote.ByteOrder",exifData) == "MM" ? bigEndian : littleEndian;
3f58c5
             byte      p[4];
3f58c5
diff --git a/src/pentaxmn.cpp b/src/pentaxmn.cpp
3f58c5
index 4fc38be..b22cb43 100644
3f58c5
--- a/src/pentaxmn.cpp
3f58c5
+++ b/src/pentaxmn.cpp
3f58c5
@@ -1167,6 +1167,8 @@ namespace Exiv2 {
3f58c5
3f58c5
     std::ostream& PentaxMakerNote::printShutterCount(std::ostream& os, const Value& value, const ExifData* metadata)
3f58c5
     {
3f58c5
+        if ( ! metadata ) return os << "undefined" ;
3f58c5
+
3f58c5
         ExifData::const_iterator dateIt = metadata->findKey(
3f58c5
                 ExifKey("Exif.PentaxDng.Date"));
3f58c5
         if (dateIt == metadata->end()) {
3f58c5
diff --git a/src/pngchunk.cpp b/src/pngchunk.cpp
3f58c5
index da4ccd0..4dcca4d 100644
3f58c5
--- a/src/pngchunk.cpp
3f58c5
+++ b/src/pngchunk.cpp
3f58c5
@@ -68,6 +68,8 @@ namespace Exiv2 {
3f58c5
                                    int*           outWidth,
3f58c5
                                    int*           outHeight)
3f58c5
     {
3f58c5
+        assert(data.size_ >= 8);
3f58c5
+
3f58c5
         // Extract image width and height from IHDR chunk.
3f58c5
3f58c5
         *outWidth  = getLong((const byte*)data.pData_,     bigEndian);
3f58c5
diff --git a/src/pngimage.cpp b/src/pngimage.cpp
3f58c5
index 11b4198..ed7399a 100644
3f58c5
--- a/src/pngimage.cpp
3f58c5
+++ b/src/pngimage.cpp
3f58c5
@@ -441,7 +441,9 @@ namespace Exiv2 {
3f58c5
 #ifdef DEBUG
3f58c5
                     std::cout << "Exiv2::PngImage::readMetadata: Found IHDR chunk (length: " << dataOffset << ")\n";
3f58c5
 #endif
3f58c5
-                    PngChunk::decodeIHDRChunk(cdataBuf, &pixelWidth_, &pixelHeight_);
3f58c5
+                    if (cdataBuf.size_ >= 8) {
3f58c5
+                        PngChunk::decodeIHDRChunk(cdataBuf, &pixelWidth_, &pixelHeight_);
3f58c5
+                    }
3f58c5
                 }
3f58c5
                 else if (!memcmp(cheaderBuf.pData_ + 4, "tEXt", 4))
3f58c5
                 {
3f58c5
diff --git a/src/tiffvisitor.cpp b/src/tiffvisitor.cpp
3f58c5
index 74f8d07..fad39b6 100644
3f58c5
--- a/src/tiffvisitor.cpp
3f58c5
+++ b/src/tiffvisitor.cpp
3f58c5
@@ -1493,6 +1493,11 @@ namespace Exiv2 {
3f58c5
         }
3f58c5
         p += 4;
3f58c5
         uint32_t isize= 0; // size of Exif.Sony1.PreviewImage
3f58c5
+
3f58c5
+        if (count > std::numeric_limits<uint32_t>::max() / typeSize) {
3f58c5
+            throw Error(59);
3f58c5
+        }
3f58c5
+
3f58c5
         uint32_t size = typeSize * count;
3f58c5
         uint32_t offset = getLong(p, byteOrder());
3f58c5
         byte* pData = p;
3f58c5
@@ -1536,7 +1541,9 @@ namespace Exiv2 {
3f58c5
             }
3f58c5
         }
3f58c5
         Value::AutoPtr v = Value::create(typeId);
3f58c5
-        assert(v.get());
3f58c5
+        if (!v.get()) {
3f58c5
+            throw Error(58);
3f58c5
+        }
3f58c5
         if ( !isize ) {
3f58c5
         	v->read(pData, size, byteOrder());
3f58c5
         } else {