- handle short EXIF user_comment fields correctly, previously Imager

  would read (and potentially) write beyond the end of an allocated block,
  or through a NULL pointer if the EXIF user_comment field was less
  than 8 bytes long.
  https://rt.cpan.org/Ticket/Display.html?id=17981

diff --git a/Changes b/Changes
index f3c6e5119c3a2c487f71b903fcf07a9ef1bf244e..47eb80785412aa23163fc3b07af08fa054e0c30d 100644 (file)
--- a/Changes
+++ b/Changes
@@ -1366,12 +1366,19 @@ Revision history for Perl extension Imager.
   custom META.yml was a waste.
 - bump to 0.47_01
 
   custom META.yml was a waste.
 - bump to 0.47_01
 

-0.48
+0.48 Fri 3 Mar 2006

 - removed unused hashinfo() function from Imager.xs
 - added =items for various methods, so Pod::Coverage will pick them up
   (Pod::Coverage tests to be added in 0.49)
 - bump to 0.48
 
 - removed unused hashinfo() function from Imager.xs
 - added =items for various methods, so Pod::Coverage will pick them up
   (Pod::Coverage tests to be added in 0.49)
 - bump to 0.48
 

+0.49
+- handle short EXIF user_comment fields correctly, previously Imager
+  would read (and potentially) write beyond the end of an allocated block,
+  or through a NULL pointer if the EXIF user_comment field was less
+  than 8 bytes long.
+  https://rt.cpan.org/Ticket/Display.html?id=17981
+

 =================================================================
 
         For latest versions check the Imager-devel pages:
 =================================================================
 
         For latest versions check the Imager-devel pages:

diff --git a/MANIFEST b/MANIFEST
index 6e1b6b00e0463c154c3f46fa614e1d2e8b0576f4..7973c02c2e1d8158f3958da196dbaf7150be110d 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -209,6 +209,7 @@ t/t91pod.t          Test POD with Test::Pod
 t/t92samples.t
 t/testtools.pl
 tags.c
 t/t92samples.t
 t/testtools.pl
 tags.c

+testimg/209_yonge.jpg  Regression test: #17981

 testimg/bad1oflow.bmp   1-bit/pixel, overflow integer on 32-bit machines
 testimg/bad1wid0.bmp    1-bit/pixel, zero width
 testimg/bad24comp.bmp   24-bit/pixel, bad compression
 testimg/bad1oflow.bmp   1-bit/pixel, overflow integer on 32-bit machines
 testimg/bad1wid0.bmp    1-bit/pixel, zero width
 testimg/bad24comp.bmp   24-bit/pixel, bad compression

diff --git a/imexif.c b/imexif.c
index 28f3a07678344bd6869d90e670fa676a79971f50..e3950948907a7a82e0caed790c14cb36d2517556 100644 (file)
--- a/imexif.c
+++ b/imexif.c
@@ -695,7 +695,7 @@ save_exif_ifd_tags(i_img *im, imtiff *tiff) {
       memcpy(user_comment, tiff->base + entry->offset, entry->size);
       /* the first 8 bytes indicate the encoding, make them into spaces
         for better presentation */
       memcpy(user_comment, tiff->base + entry->offset, entry->size);
       /* the first 8 bytes indicate the encoding, make them into spaces
         for better presentation */

-      for (i = 0; i < 8; ++i) {
+      for (i = 0; i < entry->size && i < 8; ++i) {

        if (user_comment[i] == '\0')
          user_comment[i] = ' ';
       }
        if (user_comment[i] == '\0')
          user_comment[i] = ' ';
       }

diff --git a/t/t101jpeg.t b/t/t101jpeg.t
index 1dc5a7dc60bba9bc045b8d50ae3e3311e87ad96a..f7eddf88266068121c3c252e0839837212fa4c10 100644 (file)
--- a/t/t101jpeg.t
+++ b/t/t101jpeg.t
@@ -2,7 +2,7 @@
 use strict;
 use lib 't';
 use Imager qw(:all);
 use strict;
 use lib 't';
 use Imager qw(:all);

-use Test::More tests => 49;
+use Test::More tests => 51;

 
 init_log("testout/t101jpeg.log",1);
 
 
 init_log("testout/t101jpeg.log",1);
 


@@ -30,7 +30,7 @@ if (!i_has_format("jpeg")) {
     $im = Imager->new(xsize=>2, ysize=>2);
     ok(!$im->write(file=>"testout/nojpeg.jpg"), "should fail to write jpeg");
     cmp_ok($im->errstr, '=~', qr/format not supported/, "check no jpeg message");
     $im = Imager->new(xsize=>2, ysize=>2);
     ok(!$im->write(file=>"testout/nojpeg.jpg"), "should fail to write jpeg");
     cmp_ok($im->errstr, '=~', qr/format not supported/, "check no jpeg message");

-    skip("no jpeg support", 45);
+    skip("no jpeg support", 47);

   }
 } else {
   open(FH,">testout/t101.jpg") || die "cannot open testout/t101.jpg for writing\n";
   }
 } else {
   open(FH,">testout/t101.jpg") || die "cannot open testout/t101.jpg for writing\n";


@@ -233,5 +233,17 @@ if (!i_has_format("jpeg")) {
       is_deeply($expect_tags, \%tags, "check tags for $filename");
     }
   }
       is_deeply($expect_tags, \%tags, "check tags for $filename");
     }
   }

+
+  { # Issue # 17981
+    # the test image has a zero-length user_comment field
+    # the code would originally attempt to convert '\0' to ' '
+    # for the first 8 bytes, even if the string was less than 
+    # 8 bytes long
+    my $im = Imager->new;
+    ok($im->read(file => 'testimg/209_yonge.jpg', type=>'jpeg'),
+       "test read of image with invalid exif_user_comment");
+    is($im->tags(name=>'exif_user_comment'), '',
+       "check exif_user_comment set correctly");
+  }

 }
 
 }
 

diff --git a/testimg/209_yonge.jpg b/testimg/209_yonge.jpg
new file mode 100644 (file)
index 0000000..2da5733
Binary files /dev/null and b/testimg/209_yonge.jpg differ