Fix issue 9324#9325
Open
kevinbackhouse wants to merge 3 commits into
Open
Conversation
kevinbackhouse
added
bug
forward-to-main
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes #9324 by hardening CRW packIfdId size/offset computation to avoid a heap buffer overflow caused by uint16_t truncation, and adds a regression test + fixtures to ensure the modify-command path fails safely with a corrupted-metadata error.
Changes:
- Prevent
uint16_ttruncation inpackIfdIdby computing insize_tand enforcing<= uint16_tmax before narrowing. - Add a system test covering the
exiv2 -mmodify-command reproduction for issue #9324. - Add new test fixtures (
.crwPoC and a command file) and include the PoC in the all-files regression set.
Show a summary per file
| File | Description |
|---|---|
| tests/regression_tests/test_regression_allfiles.py | Adds the new PoC CRW file to the “valid files” regression corpus. |
| tests/bugfixes/github/test_issue_9324.py | New system test validating safe failure behavior for the reported overflow scenario. |
| test/data/issue_9324_poc.txt | New modify-command file crafted to reproduce the original overflow condition. |
| src/crwimage_int.cpp | Fixes the overflow/truncation bug in packIfdId by using checked arithmetic and bounds enforcement. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Low
Comment on lines
+9
to
+12
| filename = "$data_path/issue_9324_poc.crw" | ||
| command_filename = "$data_path/issue_9324_poc.txt" | ||
| commands = [f"$exiv2 -m $command_filename $filename"] | ||
| retval = [1] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes: #9324