Recent changes to bugs

#130 libexif-0.6.21 Heap Buffer Overflow due to a programming mistake

Dan Fandrich — Mon, 18 May 2020 20:13:41 -0000

status: open --> closed-fixed
assigned_to: Marcus Meissner

#130 libexif-0.6.21 Heap Buffer Overflow due to a programming mistake

Dan Fandrich — Mon, 18 May 2020 20:12:58 -0000

This is fixed in 0.6.22

#132 Heap Out-of-Bounds Memory Access

Dan Fandrich — Fri, 12 Jul 2019 11:23:25 -0000

status: open-accepted --> closed-fixed
private: Yes --> No

#134 Timeout (78443587)

Dan Fandrich — Thu, 14 Mar 2019 18:25:01 -0000

status: open-accepted --> closed-fixed

#134 Timeout (78443587)

Dan Fandrich — Thu, 14 Mar 2019 18:24:46 -0000

The fix mentioned in the previous comment was submitted as commit 6aa11df5.

#133 Timeout (37792047)

Dan Fandrich — Thu, 14 Mar 2019 18:24:04 -0000

status: open-accepted --> closed-fixed

#133 Timeout (37792047)

Dan Fandrich — Thu, 14 Mar 2019 18:23:15 -0000

The fix mentioned in the previous comment was submitted as commit 6aa11df5/

#53 exif crashes when removing thumbnail from jpeg image

Dan Fandrich — Sat, 30 Jun 2018 19:37:02 -0000

status: open --> closed-fixed
assigned_to: Dan Fandrich
Group: -->

#53 exif crashes when removing thumbnail from jpeg image

Dan Fandrich — Sat, 30 Jun 2018 19:36:27 -0000

I'm attaching a file that seems to show the issue here, although it doesn't give me a SIGSEGV (yet) but does show a lot of Conditional jump or move depends on uninitialised value(s) errors under valgrind.

The underlying issue was solved in commit 72e9fb36 by ensuring the size parameter is initialized to 0.

#74 int to short sign extension bug (MSVC C++) libexif 0.6.15

Dan Fandrich — Sat, 30 Jun 2018 16:01:55 -0000

Here is the proposed patch in unified diff form.

Rather than 0xffff & does it work with an explicit cast to the enum type? And is that change really necessary on entry->components since both sides are unsigned?