meta-openembedded/meta-oe/recipes-support/exiv2/exiv2/CVE-2021-29464.patch

From 61734d8842cb9cc59437463e3bac54d6231d9487 Mon Sep 17 00:00:00 2001
From: Wang Mingyu <wangmy@fujitsu.com>
Date: Tue, 18 May 2021 10:52:54 +0900
Subject: [PATCH] modify

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 src/jp2image.cpp | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index 52723a4..0ac4f50 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -643,11 +643,11 @@ static void boxes_check(size_t b,size_t m)
     void Jp2Image::encodeJp2Header(const DataBuf& boxBuf,DataBuf& outBuf)
     {
         DataBuf output(boxBuf.size_ + iccProfile_.size_ + 100); // allocate sufficient space
-        int     outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output?
-        int      inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf?
+        long    outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output?
+        long    inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf?
         Jp2BoxHeader* pBox   = (Jp2BoxHeader*) boxBuf.pData_;
-        int32_t       length = getLong((byte*)&pBox->length, bigEndian);
-        int32_t       count  = sizeof (Jp2BoxHeader);
+        uint32_t      length = getLong((byte*)&pBox->length, bigEndian);
+        uint32_t      count  = sizeof (Jp2BoxHeader);
         char*         p      = (char*) boxBuf.pData_;
         bool          bWroteColor = false ;
 
@@ -664,6 +664,7 @@ static void boxes_check(size_t b,size_t m)
 #ifdef EXIV2_DEBUG_MESSAGES
                 std::cout << "Jp2Image::encodeJp2Header subbox: "<< toAscii(subBox.type) << " length = " << subBox.length << std::endl;
 #endif
+                enforce(subBox.length <= length - count, Exiv2::kerCorruptedMetadata);
                 count        += subBox.length;
                 newBox.type   = subBox.type;
             } else {
@@ -672,12 +673,13 @@ static void boxes_check(size_t b,size_t m)
                 count = length;
             }
 
-            int32_t newlen = subBox.length;
+            uint32_t newlen = subBox.length;
             if ( newBox.type == kJp2BoxTypeColorHeader ) {
                 bWroteColor = true ;
                 if ( ! iccProfileDefined() ) {
                     const char* pad   = "\x01\x00\x00\x00\x00\x00\x10\x00\x00\x05\x1cuuid";
                     uint32_t    psize = 15;
+                    enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
                     ul2Data((byte*)&newBox.length,psize      ,bigEndian);
                     ul2Data((byte*)&newBox.type  ,newBox.type,bigEndian);
                     ::memcpy(output.pData_+outlen                     ,&newBox            ,sizeof(newBox));
@@ -686,6 +688,7 @@ static void boxes_check(size_t b,size_t m)
                 } else {
                     const char* pad   = "\0x02\x00\x00";
                     uint32_t    psize = 3;
+                    enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
                     ul2Data((byte*)&newBox.length,psize+iccProfile_.size_,bigEndian);
                     ul2Data((byte*)&newBox.type,newBox.type,bigEndian);
                     ::memcpy(output.pData_+outlen                     ,&newBox            ,sizeof(newBox)  );
@@ -694,6 +697,7 @@ static void boxes_check(size_t b,size_t m)
                     newlen = psize + iccProfile_.size_;
                 }
             } else {
+                enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
                 ::memcpy(output.pData_+outlen,boxBuf.pData_+inlen,subBox.length);
             }
 
-- 
2.25.1