[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/libexif/devel libexif-0.6.12-recurse.patch, NONE, 1.1 libexif.spec, 1.12, 1.13



Author: mclasen

Update of /cvs/dist/rpms/libexif/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv16541

Modified Files:
	libexif.spec 
Added Files:
	libexif-0.6.12-recurse.patch 
Log Message:
Prevent infinite recursion


libexif-0.6.12-recurse.patch:
 exif-data.c |   34 +++++++++++++++++++++++++---------
 1 files changed, 25 insertions(+), 9 deletions(-)

--- NEW FILE libexif-0.6.12-recurse.patch ---
--- libexif-0.6.12/libexif/exif-data.c.recurse	2005-05-06 13:35:17.610294000 -0400
+++ libexif-0.6.12/libexif/exif-data.c	2005-05-06 13:37:35.112654000 -0400
@@ -284,9 +284,10 @@
 }
 
 static void
-exif_data_load_data_content (ExifData *data, ExifContent *ifd,
-			     const unsigned char *d,
-			     unsigned int ds, unsigned int offset)
+exif_data_load_data_content_recurse (ExifData *data, ExifContent *ifd,
+				     const unsigned char *d,
+				     unsigned int ds, unsigned int offset,
+				     unsigned int level)
 {
 	ExifLong o, thumbnail_offset = 0, thumbnail_length = 0;
 	ExifShort n;
@@ -296,6 +297,13 @@
 
 	if (!data || !data->priv) return;
 
+	if (level > 150)
+	  {
+	    exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+		      "Deep recursion in exif_data_load_data_content");
+	    return 0;
+	  }
+
 	/* Read the number of entries */
 	if (offset >= ds - 1) return;
 	n = exif_get_short (d + offset, data->priv->order);
@@ -320,18 +328,18 @@
 			switch (tag) {
 			case EXIF_TAG_EXIF_IFD_POINTER:
 				CHECK_REC (EXIF_IFD_EXIF);
-				exif_data_load_data_content (data,
-					data->ifd[EXIF_IFD_EXIF], d, ds, o);
+				exif_data_load_data_content_recurse (data,
+					data->ifd[EXIF_IFD_EXIF], d, ds, o, level + 1);
 				break;
 			case EXIF_TAG_GPS_INFO_IFD_POINTER:
 				CHECK_REC (EXIF_IFD_GPS);
-				exif_data_load_data_content (data,
-					data->ifd[EXIF_IFD_GPS], d, ds, o);
+				exif_data_load_data_content_recurse (data,
+					data->ifd[EXIF_IFD_GPS], d, ds, o, level + 1);
 				break;
 			case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
 				CHECK_REC (EXIF_IFD_INTEROPERABILITY);
-				exif_data_load_data_content (data,
-					data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds, o);
+				exif_data_load_data_content_recurse (data,
+					data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds, o, level + 1);
 				break;
 			case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
 				thumbnail_offset = o;
@@ -373,6 +381,14 @@
 }
 
 static void
+exif_data_load_data_content (ExifData *data, ExifContent *ifd,
+			     const unsigned char *d,
+			     unsigned int ds, unsigned int offset)
+{
+  exif_data_load_data_content_recurse (data, ifd, d, ds, offset, 0);
+}
+
+static void
 exif_data_save_data_content (ExifData *data, ExifContent *ifd,
 			     unsigned char **d, unsigned int *ds,
 			     unsigned int offset)


Index: libexif.spec
===================================================================
RCS file: /cvs/dist/rpms/libexif/devel/libexif.spec,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- libexif.spec	25 Apr 2005 02:49:04 -0000	1.12
+++ libexif.spec	6 May 2005 18:29:45 -0000	1.13
@@ -11,6 +11,7 @@
 Patch0: libexif-0.6.12-gcc4.patch
 # fixed in libexif CVS
 Patch1: libexif-0.6.12-odd.patch
+Patch2: libexif-0.6.12-recurse.patch
 
 %description
 Most digital cameras produce EXIF files, which are JPEG files with
@@ -30,6 +31,7 @@
 %setup -q
 %patch0 -p1 -b .gcc4
 %patch1 -p1 -b .odd
+%patch2 -p1 -b .recurse
 
 %build
 %configure
@@ -61,6 +63,9 @@
 %{_libdir}/pkgconfig/libexif.pc
 
 %changelog
+* Fri May  6 2005 Matthias Clasen <mclasen redhat com>
+- Prevent infinite recursion (#156365)
+
 * Sun Apr 24 2005 Matthias Clasen <mclasen redhat com>
 - Fix MakerNote handling (#153282)
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]