third_party/exiv2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2007 from kevinbackhouse/FixIssue2006

Browse Source 
Fix integer overflow in PanasonicMakerNote::printAccelerometer
This commit is contained in:
Kevin Backhouse 2021-12-06 10:31:20 +00:00 committed by GitHub
commit 65fad9db0e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 27 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/panasonicmn_int.cpp
View File

@ -691,17 +691,15 @@ namespace Exiv2 {
std::ostream& PanasonicMakerNote::printAccelerometer(std::ostream& os, const Value& value, const ExifData*)
{
// value is stored as unsigned int, but should be readed as signed int, so manually convert it
int i = value.toLong();
i = i - ((i & 0x8000) >> 15) * 0xffff;
// value is stored as unsigned int, but should be read as int16_t.
const int16_t i = static_cast<int16_t>(value.toLong());
return os << i;
} // PanasonicMakerNote::printAccelerometer
std::ostream& PanasonicMakerNote::printRollAngle(std::ostream& os, const Value& value, const ExifData*)
{
// roll angle is stored as signed int, but tag states to be unsigned int
int i = value.toLong();
i = i - ((i & 0x8000) >> 15) * 0xffff;
// value is stored as unsigned int, but should be read as int16_t.
const int16_t i = static_cast<int16_t>(value.toLong());
std::ostringstream oss;
oss.copyfmt(os);
os << std::fixed << std::setprecision(1) << i / 10.0;
@ -712,10 +710,8 @@ namespace Exiv2 {
std::ostream& PanasonicMakerNote::printPitchAngle(std::ostream& os, const Value& value, const ExifData*)
{
// pitch angle is stored as signed int, but tag states to be unsigned int
// change sign to be compatible with ExifTool: positive is upwards
int i = value.toLong();
i = i - ((i & 0x8000) >> 15) * 0xffff;
// value is stored as unsigned int, but should be read as int16_t.
const int16_t i = static_cast<int16_t>(value.toLong());
std::ostringstream oss;
oss.copyfmt(os);
os << std::fixed << std::setprecision(1) << -i / 10.0;

BIN
test/data/issue_2006_poc.tiff Normal file
View File

Binary file not shown.

21
tests/bugfixes/github/test_issue_2006.py Normal file
View File

@ -0,0 +1,21 @@
# -*- coding: utf-8 -*-
from system_tests import CaseMeta, path
class PanasonicMakerPrintAccelerometerIntOverflow(metaclass=CaseMeta):
"""
Regression test for the bug described in:
https://github.com/Exiv2/exiv2/issues/2006
"""
url = "https://github.com/Exiv2/exiv2/issues/2006"
filename = path("$data_path/issue_2006_poc.tiff")
commands = ["$exiv2 -q -PE $filename"]
stderr = [""]
stdout = ["""Exif.Image.Make Ascii 32 Panasonic
Exif.Image.DNGPrivateData 0x2020 32 80 97 110 97 115 111 110 105 99 32 32 32 0 32 32 255 32 32 32 32 32 255 255 255 32 255 255 198 52 32 32 0
Exif.MakerNote.Offset Long 1 48
Exif.MakerNote.ByteOrder Ascii 3 MM
Exif.Panasonic.AccelerometerY SLong 4 -224
"""]
retval = [0]