Fix issue 9324

src/crwimage_int.cpp

@@ -5,6 +5,7 @@
 #include "enforce.hpp"
 #include "error.hpp"
 #include "i18n.h"  // NLS support.
+#include "safe_op.hpp"
 
 #include <ctime>
 #include <iostream>
@@ -1011,10 +1012,11 @@ DataBuf packIfdId(const ExifData& exifData, IfdId ifdId, ByteOrder byteOrder) {
   for (auto&& exif : exifData) {
     if (exif.ifdId() != ifdId)
       continue;
-    const uint16_t s = exif.tag() * 2 + static_cast<uint16_t>(exif.size());
+    const size_t s = Safe::add<size_t>(exif.tag() * 2, exif.size());
+    enforce(s <= static_cast<size_t>(std::numeric_limits<uint16_t>::max()), ErrorCode::kerCorruptedMetadata);
     if (s <= size) {
       if (len < s)
-        len = s;
+        len = static_cast<uint16_t>(s);
       exif.copy(buf.data(exif.tag() * 2), byteOrder);
     } else {
       EXV_ERROR << "packIfdId out-of-bounds error: s = " << std::dec << s << "\n";

tests/bugfixes/github/test_issue_9324.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class test_issue_9324_packIfdId_overflow(metaclass=system_tests.CaseMeta):
+    url = "https://github.com/Exiv2/exiv2/issues/9324"
+
+    filename = "$data_path/issue_9324_poc.crw"
+    command_filename = "$data_path/issue_9324_poc.txt"
+    commands = ["$exiv2 -m $command_filename $filename"]
+    retval = [1]
+    stderr = [
+        """Exiv2 exception in modify action for file $filename:
+$kerCorruptedMetadata
+"""
+    ]
+    stdout = [""]

tests/regression_tests/test_regression_allfiles.py

@@ -130,6 +130,7 @@ def get_valid_files(data_dir):
         "xmpsdk.xmp",
         "issue_3513_poc.psd",
         "issue_3511_poc.eps",
+        "issue_9324_poc.crw",
         # large file that creates 11Mb of output so let's exclude it
         "ReaganLargeTiff.tiff",
         # files that don't create any output