Description: Add a failsafe on the maximum number of Canon MakerNote subtags (CVE-2020-13114)
 A malicious file could be crafted to cause extremely large values in some
 tags without tripping any buffer range checks.  This is bad with the libexif
 representation of Canon MakerNotes because some arrays are turned into
 individual tags that the application must loop around.
 .
 The largest value I've seen for failsafe_size in a (very small) sample of valid
 Canon files is <5000.  The limit is set two orders of magnitude larger to avoid
 tripping up falsely in case some models use much larger values.
 .
 Patch from Google.
Origin: commit:e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
Author: Dan Fandrich <dan@coneharvesters.com>
Last-Update: 2020-05-24

---
 libexif/canon/exif-mnote-data-canon.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

--- a/libexif/canon/exif-mnote-data-canon.c
+++ b/libexif/canon/exif-mnote-data-canon.c
@@ -34,6 +34,9 @@
 
 #define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize ))
 
+/* Total size limit to prevent abuse by DoS */
+#define FAILSAFE_SIZE_MAX 1000000L
+
 static void
 exif_mnote_data_canon_clear (ExifMnoteDataCanon *n)
 {
@@ -204,6 +207,7 @@
 	ExifMnoteDataCanon *n = (ExifMnoteDataCanon *) ne;
 	ExifShort c;
 	size_t i, tcount, o, datao;
+	long failsafe_size = 0;
 
 	if (!n || !buf || !buf_size) {
 		exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
@@ -295,6 +299,23 @@
 			memcpy (n->entries[tcount].data, buf + dataofs, s);
 		}
 
+		/* Track the size of decoded tag data. A malicious file could
+		 * be crafted to cause extremely large values here without
+		 * tripping any buffer range checks.  This is especially bad
+		 * with the libexif representation of Canon MakerNotes because
+		 * some arrays are turned into individual tags that the
+		 * application must loop around. */
+		failsafe_size += mnote_canon_entry_count_values(&n->entries[tcount]);
+
+		if (failsafe_size > FAILSAFE_SIZE_MAX) {
+			/* Abort if the total size of the data in the tags extraordinarily large, */
+			exif_mem_free (ne->mem, n->entries[tcount].data);
+			exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
+					  "ExifMnoteCanon", "Failsafe tag size overflow (%lu > %ld)",
+					  failsafe_size, FAILSAFE_SIZE_MAX);
+			break;
+		}
+
 		/* Tag was successfully parsed */
 		++tcount;
 	}