Merge pull request #757 from Exiv2/fix_756_0.27

Fix #756 for 0.27
Exiv2 · Mar 26, 2019 · b148cfa · b148cfa
2 parents 8db17df + 7bd929d
commit b148cfa
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 2 deletions.
diff --git a/src/nikonmn_int.cpp b/src/nikonmn_int.cpp
@@ -370,8 +370,12 @@ namespace Exiv2 {
                                                const ExifData*)
     {
         if (value.count() >= 1) {
-            unsigned long focusArea = value.toLong(0);
-            os << nikonFocusarea[focusArea] ;
+            const unsigned long focusArea = value.toLong(0);
+            if (focusArea >= EXV_COUNTOF(nikonFocusarea)) {
+                os << "Invalid value";
+            } else {
+                os << nikonFocusarea[focusArea];
+            }
         }
         if (value.count() >= 2) {
             os << "; ";

diff --git a/test/data/NikonMakerNotePrint0x088_overread b/test/data/NikonMakerNotePrint0x088_overread
diff --git a/tests/bugfixes/github/test_issue_756.py b/tests/bugfixes/github/test_issue_756.py
@@ -0,0 +1,20 @@
+import system_tests
+
+
+class BufferOverReadInNikon1MakerNotePrint0x0088(
+        metaclass=system_tests.CaseMeta):
+
+    url = "https://github.com/Exiv2/exiv2/issues/756"
+
+    filename = system_tests.path(
+        "$data_path/NikonMakerNotePrint0x088_overread"
+    )
+    commands = ["$exiv2 -pt --grep AFFocusPos $filename"]
+    stdout = [
+        """Exif.Nikon1.AFFocusPos                       Undefined   4  Invalid value; Center
+"""
+    ]
+    stderr = [""]
+    retval = [0]
+
+    compare_stderr = system_tests.check_no_ASAN_UBSAN_errors