From a6e89eb792f91d76024d94e21698f54bad2111ae Mon Sep 17 00:00:00 2001 From: Kevin Backhouse Date: Sat, 18 Jul 2026 22:26:04 +0100 Subject: [PATCH 1/2] Regression test for https://github.com/Exiv2/exiv2/issues/9324 --- test/data/issue_9324_poc.crw | Bin 0 -> 20 bytes test/data/issue_9324_poc.txt | 1 + tests/bugfixes/github/test_issue_9324.py | 18 ++++++++++++++++++ .../test_regression_allfiles.py | 1 + 4 files changed, 20 insertions(+) create mode 100644 test/data/issue_9324_poc.crw create mode 100644 test/data/issue_9324_poc.txt create mode 100644 tests/bugfixes/github/test_issue_9324.py diff --git a/test/data/issue_9324_poc.crw b/test/data/issue_9324_poc.crw new file mode 100644 index 0000000000000000000000000000000000000000..37f8912d906b855818e02d2ec0dbf78bbf1d11be GIT binary patch literal 20 YcmebD Date: Sun, 7 Jun 2026 22:40:27 +0100 Subject: [PATCH 2/2] Check for integer overflow --- src/crwimage_int.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/crwimage_int.cpp b/src/crwimage_int.cpp index 9e6ebd5485..2d61068177 100644 --- a/src/crwimage_int.cpp +++ b/src/crwimage_int.cpp @@ -5,6 +5,7 @@ #include "enforce.hpp" #include "error.hpp" #include "i18n.h" // NLS support. +#include "safe_op.hpp" #include #include @@ -1011,10 +1012,11 @@ DataBuf packIfdId(const ExifData& exifData, IfdId ifdId, ByteOrder byteOrder) { for (auto&& exif : exifData) { if (exif.ifdId() != ifdId) continue; - const uint16_t s = exif.tag() * 2 + static_cast(exif.size()); + const size_t s = Safe::add(exif.tag() * 2, exif.size()); + enforce(s <= static_cast(std::numeric_limits::max()), ErrorCode::kerCorruptedMetadata); if (s <= size) { if (len < s) - len = s; + len = static_cast(s); exif.copy(buf.data(exif.tag() * 2), byteOrder); } else { EXV_ERROR << "packIfdId out-of-bounds error: s = " << std::dec << s << "\n";