#769: Fixed calculation of binary array size in the case when the array elements are not sorted in ascending order, added test case.

src/tiffcomposite.cpp

@@ -1689,11 +1689,19 @@ namespace Exiv2 {
 
         if (elements_.empty()) return 0;
 
+        // Remaining assumptions:
+        // - array elements don't "overlap"
+        // - no duplicate tags in the array
         uint32_t idx = 0;
+        uint32_t sz = cfg()->tagStep();
         for (Components::const_iterator i = elements_.begin(); i != elements_.end(); ++i) {
-            idx = EXV_MAX(idx, (*i)->tag() * cfg()->tagStep());
-            idx += (*i)->size();
+            if ((*i)->tag() > idx) {
+                idx = (*i)->tag();
+                sz = (*i)->size();
+            }
         }
+        idx = idx * cfg()->tagStep() + sz;
+
         if (cfg()->hasFillers_ && def()) {
             const ArrayDef* lastDef = def() + defSize() - 1;
             uint16_t lastTag = static_cast<uint16_t>(lastDef->idx_ / cfg()->tagStep());

test/bugfixes-test.sh

@@ -186,6 +186,12 @@ cp -f ../data/exiv2-empty.jpg $filename
 $bin/exiv2 -u -v -M"set Exif.Image.Make Samsung" $filename
 $samples/easyaccess-test $filename
 
+num=769
+filename=exiv2-bug$num.jpg
+cp -f ../data/exiv2-empty.jpg $filename
+$bin/exiv2 -u -v -M"add Exif.Image.Make Canon" -M"add Exif.CanonCs.0x0001 Short 1" -M"add Exif.CanonCs.0x0000 Short 2" $filename
+$bin/exiv2 -u -v -PEkyct $filename
+
 ) > $results 2>&1
 
 # ----------------------------------------------------------------------