fix range checking on IFD entry data types. This could cause various

crashes.
Fixes #18496

diff --git a/MANIFEST b/MANIFEST
index 6bee1b17c6fabab697d6f459dd99e23dda74d77c..d31885a377d7578efd6eada551859e4d0cee1a20 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -299,6 +299,7 @@ testimg/winrgb4.bmp  4-bit bmp base
 testimg/winrgb4off.bmp  4-bit bmp with image data offset from header
 testimg/winrgb8.bmp  8-bit bmp base
 testimg/winrgb8off.bmp  8-bit bmp with image data offset from header
+testimg/zerotype.jpg   Image with a zero type entry in the EXIF data
 tga.c           Reading and writing Targa files
 tiff.c
 trans2.c

diff --git a/imexif.c b/imexif.c
index e3950948907a7a82e0caed790c14cb36d2517556..186dbb3b04b05a175393b98365d6fc07793a3fa5 100644 (file)
--- a/imexif.c
+++ b/imexif.c
@@ -936,7 +936,7 @@ tiff_load_ifd(imtiff *tiff, unsigned long offset) {
     entry->tag = tiff_get16(tiff, base);
     entry->type = tiff_get16(tiff, base+2);
     entry->count = tiff_get32(tiff, base+4);
-    if (entry->type >= 1 || entry->type <= ift_last) {
+    if (entry->type >= 1 && entry->type <= ift_last) {
       entry->item_size = type_sizes[entry->type];
       entry->size = entry->item_size * entry->count;
       if (entry->size / entry->item_size != entry->count) {

diff --git a/t/t101jpeg.t b/t/t101jpeg.t
index 049643bac882050956dae6ff7e6d42aab1e78949..6ea52074e8486ff41fbd38c06f44c37f335c34c2 100644 (file)
--- a/t/t101jpeg.t
+++ b/t/t101jpeg.t
@@ -2,7 +2,7 @@
 use strict;
 use lib 't';
 use Imager qw(:all);
-use Test::More tests => 56;
+use Test::More tests => 57;
 
 init_log("testout/t101jpeg.log",1);
 
@@ -30,7 +30,7 @@ if (!i_has_format("jpeg")) {
     $im = Imager->new(xsize=>2, ysize=>2);
     ok(!$im->write(file=>"testout/nojpeg.jpg"), "should fail to write jpeg");
     cmp_ok($im->errstr, '=~', qr/format not supported/, "check no jpeg message");
-    skip("no jpeg support", 52);
+    skip("no jpeg support", 53);
   }
 } else {
   open(FH,">testout/t101.jpg") || die "cannot open testout/t101.jpg for writing\n";
@@ -272,5 +272,17 @@ if (!i_has_format("jpeg")) {
     is($im->errstr, "only 1 or 3 channels images can be saved as JPEG",
        "check the error message");
   }
+ SKIP:
+  { # Issue # 18496
+    # If a jpeg with EXIF data containing an (invalid) IFD entry with a 
+    # type of zero is read then Imager crashes with a Floating point 
+    # exception
+    # testimg/zerojpeg.jpg was manually modified from exiftest.jpg to
+    # reproduce the problem.
+    Imager::i_exif_enabled()
+       or skip("no exif support", 1);
+    my $im = Imager->new;
+    ok($im->read(file=>'testimg/zerotype.jpg'), "shouldn't crash");
+  }
 }
 

diff --git a/testimg/zerotype.jpg b/testimg/zerotype.jpg
new file mode 100755 (executable)
index 0000000..d5f2d90
Binary files /dev/null and b/testimg/zerotype.jpg differ