The branch, master has been updated via 7caa2a65d9d73848e0d4167fed86aac6780f4bbe (commit) from d4eb01f2814431aef1f4160a00ed495560ff35bd (commit) - Log ----------------------------------------------------------------- commit 7caa2a65d9d73848e0d4167fed86aac6780f4bbe Author: Leo Izen <leo.izen@gmail.com> AuthorDate: Wed Aug 20 21:40:28 2025 -0400 Commit: Leo Izen <leo.izen@gmail.com> CommitDate: Thu Aug 21 15:40:45 2025 -0400 avcodec/exif: fix some coverity errors This commit fixes some memory and security issues due to improper sanitizing and checks. Fixes: - CID 1665100..1665107 Signed-off-by: Leo Izen <leo.izen@gmail.com> Reportedy-by: James Almer <jamrial@gmail.com> diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 48959eb9b3..2513ee4ec0 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -322,12 +322,17 @@ static int exif_read_values(void *logctx, GetByteContext *gb, int le, AVExifEntr break; case AV_TIFF_UNDEFINED: case AV_TIFF_BYTE: + /* these three fields are aliased to entry->value.ptr via a union */ + /* and entry->value.ptr will always be nonzero here */ + av_assert0(entry->value.ubytes); bytestream2_get_buffer(gb, entry->value.ubytes, entry->count); break; case AV_TIFF_SBYTE: + av_assert0(entry->value.sbytes); bytestream2_get_buffer(gb, entry->value.sbytes, entry->count); break; case AV_TIFF_STRING: + av_assert0(entry->value.str); bytestream2_get_buffer(gb, entry->value.str, entry->count); break; } @@ -471,6 +476,10 @@ static int exif_decode_tag(void *logctx, GetByteContext *gb, int le, av_log(logctx, AV_LOG_DEBUG, "TIFF Tag: id: 0x%04x, type: %d, count: %u, offset: %d, " "payload: %" PRIu32 "\n", entry->id, type, count, tell, payload); + /* AV_TIFF_IFD is the largest, numerically */ + if (type > AV_TIFF_IFD) + return AVERROR_INVALIDDATA; + is_ifd = type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG; if (is_ifd) { @@ -541,6 +550,11 @@ static int exif_parse_ifd_list(void *logctx, GetByteContext *gb, int le, av_log(logctx, AV_LOG_ERROR, "not enough bytes remaining in EXIF buffer. entries: %" PRIu32 "\n", entries); return AVERROR_INVALIDDATA; } + if (entries > 4096) { + /* that is a lot of entries, probably an error */ + av_log(logctx, AV_LOG_ERROR, "too many entries: %" PRIu32 "\n", entries); + return AVERROR_INVALIDDATA; + } ifd->count = entries; av_log(logctx, AV_LOG_DEBUG, "entry count for IFD: %u\n", ifd->count); @@ -729,7 +743,12 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, if (header_mode != AV_EXIF_ASSUME_BE && header_mode != AV_EXIF_ASSUME_LE) { /* these constants are be32 in both cases */ - bytestream2_put_be32(&pb, le ? EXIF_II_LONG : EXIF_MM_LONG); + /* this is a #if instead of a ternary to suppress a deadcode warning */ +#if AV_HAVE_BIGENDIAN + bytestream2_put_be32(&pb, EXIF_MM_LONG); +#else + bytestream2_put_be32(&pb, EXIF_II_LONG); +#endif tput32(&pb, le, 8); } @@ -897,10 +916,10 @@ static int exif_ifd_to_dict(void *logctx, const char *prefix, const AVExifMetada if (ret < 0) goto end; ret = av_dict_set(metadata, key, value, AV_DICT_DONT_STRDUP_KEY | AV_DICT_DONT_STRDUP_VAL); - if (ret < 0) - goto end; key = NULL; value = NULL; + if (ret < 0) + goto end; } else { av_freep(&key); } @@ -970,7 +989,7 @@ static int exif_attach_ifd(void *logctx, AVFrame *frame, const AVExifMetadata *i ret = av_exif_ifd_to_dict(logctx, cloned ? cloned : ifd, &frame->metadata); if (ret < 0) - return ret; + goto end; if (cloned || !og) { ret = av_exif_write(logctx, cloned ? cloned : ifd, &written, AV_EXIF_TIFF_HEADER); ----------------------------------------------------------------------- Summary of changes: libavcodec/exif.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) hooks/post-receive --