Description: Prevent compiler optimization of a buffer overflow check A compiler optimization could remove a buffer overflow check, making a buffer overflow possible with some EXIF tags. Origin: commit:9266d14b5ca4e29b970fa03272318e5f99386e06 Author: Marcus Meissner Forwarded: not-needed Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-0452 Last-Update: 2020-11-05 --- libexif/exif-entry.c | 4 ++-- 1 files changed, 4 insertions(+), 3 deletions(-) --- a/libexif/exif-entry.c +++ b/libexif/exif-entry.c @@ -1376,8 +1376,8 @@ case EXIF_TAG_XP_KEYWORDS: case EXIF_TAG_XP_SUBJECT: { - /* Sanity check the size to prevent overflow */ - if (e->size+sizeof(unsigned short) < e->size) break; + /* Sanity check the size to prevent overflow. Note EXIF files are 64kb at most. */ + if (e->size >= 65536 - sizeof(uint16_t)*2) break; /* The tag may not be U+0000-terminated , so make a local U+0000-terminated copy before converting it */