File: CVE-2023-0645.patch

package info (click to toggle)
jpeg-xl 0.7.0-10%2Bdeb12u1
  • links: PTS, VCS
  • area: main
  • in suites: bookworm
  • size: 8,584 kB
  • sloc: cpp: 106,433; python: 2,781; sh: 2,776; ansic: 976; java: 218; makefile: 84; xml: 13
file content (51 lines) | stat: -rw-r--r-- 1,577 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
From a7c8428b61299f3b055cbbdbba3fbcd8cb38d084 Mon Sep 17 00:00:00 2001
From: a-shvedov <60114847+a-shvedov@users.noreply.github.com>
Date: Wed, 1 Feb 2023 12:17:22 +0300
Subject: [PATCH] Update exif.h (#2101)

* Update exif.h

* Update lib/jxl/exif.h

Co-authored-by: Moritz Firsching <firsching@google.com>

* fix AUTHORS

* fix lint

---------

Co-authored-by: Moritz Firsching <firsching@google.com>
---
 AUTHORS        | 1 +
 lib/jxl/exif.h | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

Index: jpeg-xl-0.7.0/AUTHORS
===================================================================
--- jpeg-xl-0.7.0.orig/AUTHORS
+++ jpeg-xl-0.7.0/AUTHORS
@@ -16,6 +16,7 @@ Cloudinary Ltd. <*@cloudinary.com>
 Google LLC <*@google.com>
 
 # Individuals:
+a-shvedov
 Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
 Alexander Sago <cagelight@gmail.com>
 Andrius Lukas Narbutas <andrius4669@gmail.com>
Index: jpeg-xl-0.7.0/lib/jxl/exif.h
===================================================================
--- jpeg-xl-0.7.0.orig/lib/jxl/exif.h
+++ jpeg-xl-0.7.0/lib/jxl/exif.h
@@ -38,9 +38,10 @@ inline size_t FindExifTagPosition(const
   bool bigendian;
   if (!IsExif(exif, &bigendian)) return 0;
   const uint8_t* t = exif.data() + 4;
-  uint32_t offset = (bigendian ? LoadBE32(t) : LoadLE32(t));
+  uint64_t offset = (bigendian ? LoadBE32(t) : LoadLE32(t));
   if (exif.size() < 12 + offset + 2 || offset < 8) return 0;
   t += offset - 4;
+  if (offset + 2 >= exif.size()) return 0;
   uint16_t nb_tags = (bigendian ? LoadBE16(t) : LoadLE16(t));
   t += 2;
   while (nb_tags > 0) {