Exiv2 · D4N · Jan 7, 2018 · Sep 26, 2017 · Sep 26, 2017 · Sep 27, 2017
diff --git a/include/exiv2/value.hpp b/include/exiv2/value.hpp
@@ -44,6 +44,7 @@
 #include <sstream>
 #include <memory>
 #include <cstring>
+#include <climits>
 
 // *****************************************************************************
 // namespace extensions
@@ -1657,19 +1658,21 @@ namespace Exiv2 {
         ok_ = true;
         return static_cast<long>(value_[n]);
     }
+// #55 crash when value_[n].first == LONG_MIN
+#define LARGE_INT 1000000
     // Specialization for rational
     template<>
     inline long ValueType<Rational>::toLong(long n) const
     {
-        ok_ = (value_[n].second != 0);
+        ok_ = (value_[n].second != 0 && -LARGE_INT < value_[n].first && value_[n].first < LARGE_INT);
         if (!ok_) return 0;
         return value_[n].first / value_[n].second;
     }
     // Specialization for unsigned rational
     template<>
     inline long ValueType<URational>::toLong(long n) const
     {
-        ok_ = (value_[n].second != 0);
+        ok_ = (value_[n].second != 0 && value_[n].first < LARGE_INT);
         if (!ok_) return 0;
         return value_[n].first / value_[n].second;
     }

diff --git a/src/basicio.cpp b/src/basicio.cpp
@@ -1035,6 +1035,7 @@ namespace Exiv2 {
     DataBuf FileIo::read(long rcount)
     {
         assert(p_->fp_ != 0);
+        if ( (size_t) rcount > size() ) throw Error(57);
         DataBuf buf(rcount);
         long readCount = read(buf.pData_, buf.size_);
         buf.size_ = readCount;

diff --git a/src/error.cpp b/src/error.cpp
@@ -105,7 +105,14 @@ namespace {
         { 49, N_("TIFF directory %1 has too many entries") }, // %1=TIFF directory name
         { 50, N_("Multiple TIFF array element tags %1 in one directory") }, // %1=tag number
         { 51, N_("TIFF array element tag %1 has wrong type") }, // %1=tag number
-        { 52, N_("%1 has invalid XMP value type `%2'") } // %1=key, %2=value type
+        { 52, N_("%1 has invalid XMP value type `%2'") }, // %1=key, %2=value type
+        { 53, N_("Not a valid ICC Profile") },
+        { 54, N_("Not valid XMP") },
+        { 55, N_("tiff directory length is too large") },
+        { 56, N_("invalid type value detected in Image::printIFDStructure") },
+        { 57, N_("invalid memory allocation request") },
+        { 58, N_("corrupted image metadata") },
+        { 59, N_("Arithmetic operation overflow") },
     };
 
 }

diff --git a/src/tags.cpp b/src/tags.cpp
@@ -2560,13 +2560,12 @@ namespace Exiv2 {
     std::ostream& print0x9204(std::ostream& os, const Value& value, const ExifData*)
     {
         Rational bias = value.toRational();
-        if (bias.second <= 0) {
-            os << "(" << bias.first << "/" << bias.second << ")";
-        }
-        else if (bias.first == 0) {
+
+        if (bias.first == 0 || bias.first == 0x80000000 ) {
             os << "0 EV";
-        }
-        else {
+        } else if (bias.second <= 0) {
+            os << "(" << bias.first << "/" << bias.second << ")";
+        } else {
             int32_t d = gcd(bias.first, bias.second);
             int32_t num = std::abs(bias.first) / d;
             int32_t den = bias.second / d;

diff --git a/src/tiffvisitor.cpp b/src/tiffvisitor.cpp
@@ -47,6 +47,7 @@ EXIV2_RCSID("@(#) $Id$")
 #include <iostream>
 #include <iomanip>
 #include <cassert>
+#include <limits>
 
 // *****************************************************************************
 namespace {
@@ -1291,11 +1292,12 @@ namespace Exiv2 {
             }
             uint16_t tag = getUShort(p, byteOrder());
             TiffComponent::AutoPtr tc = TiffCreator::create(tag, object->group());
-            // The assertion typically fails if a component is not configured in
-            // the TIFF structure table
-            assert(tc.get());
-            tc->setStart(p);
-            object->addChild(tc);
+            if (tc.get()) {
+                tc->setStart(p);
+                object->addChild(tc);
+            } else {
+               EXV_WARNING << "Unable to handle tag " << tag << ".\n";
+            }
             p += 12;
         }
 
@@ -1490,6 +1492,9 @@ namespace Exiv2 {
             return;
         }
         p += 4;
+        if (count > std::numeric_limits<uint32_t>::max() / typeSize) {
+            throw Error(59);
+        }
         uint32_t size = typeSize * count;
         int32_t offset = getLong(p, byteOrder());
         byte* pData = p;
@@ -1508,7 +1513,19 @@ namespace Exiv2 {
                 size = 0;
         }
         if (size > 4) {
+            // setting pData to pData_ + baseOffset() + offset can result in pData pointing to invalid memory,
+            // as offset can be arbitrarily large
+            if ((static_cast<uintptr_t>(baseOffset()) > std::numeric_limits<uintptr_t>::max() - static_cast<uintptr_t>(offset))
+             || (static_cast<uintptr_t>(baseOffset() + offset) > std::numeric_limits<uintptr_t>::max() - reinterpret_cast<uintptr_t>(pData_)))
+            {
+                throw Error(59);
+            }
+            if (pData_ + static_cast<uintptr_t>(baseOffset()) + static_cast<uintptr_t>(offset) > pLast_) {
+                throw Error(58);
+            }
             pData = const_cast<byte*>(pData_) + baseOffset() + offset;
+
+	    // check for size being invalid
             if (size > static_cast<uint32_t>(pLast_ - pData)) {
 #ifndef SUPPRESS_WARNINGS
                 EXV_ERROR << "Upper boundary of data for "
@@ -1528,7 +1545,9 @@ namespace Exiv2 {
             }
         }
         Value::AutoPtr v = Value::create(typeId);
-        assert(v.get());
+        if (!v.get()) {
+            throw Error(58);
+        }
         v->read(pData, size, byteOrder());
 
         object->setValue(v);

diff --git a/test/bugfixes-test.sh b/test/bugfixes-test.sh
@@ -377,6 +377,104 @@ source ./functions.source
 	copyTestFile              $filename
 	runTest exiv2 -pa -g zone $filename
 
+    num=g57
+    printf "$num " >&3
+    filename=POC
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g79
+    printf "$num " >&3
+    filename=POC2
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g52
+    printf "$num " >&3
+    filename=POC5
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g51
+    printf "$num " >&3
+    filename=POC4
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g50
+    printf "$num " >&3
+    filename=POC3
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g53
+    printf "$num " >&3
+    filename=POC6
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g54
+    printf "$num " >&3
+    filename=POC9
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g58
+    printf "$num " >&3
+    filename=POC11
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g59
+    printf "$num " >&3
+    filename=POC12
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g60
+    printf "$num " >&3
+    filename=POC13
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g71
+    printf "$num " >&3
+    filename=003-heap-buffer-over
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g73
+    printf "$num " >&3
+    filename=02-Invalid-mem-def
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g74
+    printf "$num " >&3
+    filename=005-invalid-mem
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
+    num=g75
+    printf "$num " >&3
+    filename=008-invalid-mem
+    echo '------>' Bug $filename '<-------' >&2
+    copyTestFile                      $filename
+    runTest exiv2                     $filename
+
 ) 3>&1 > $results 2>&1
 
 printf "\n"

diff --git a/test/data/003-heap-buffer-over b/test/data/003-heap-buffer-over
diff --git a/test/data/005-invalid-mem b/test/data/005-invalid-mem
diff --git a/test/data/008-invalid-mem b/test/data/008-invalid-mem
diff --git a/test/data/02-Invalid-mem-def b/test/data/02-Invalid-mem-def
diff --git a/test/data/POC b/test/data/POC
diff --git a/test/data/POC11 b/test/data/POC11
diff --git a/test/data/POC12 b/test/data/POC12
diff --git a/test/data/POC13 b/test/data/POC13
diff --git a/test/data/POC2 b/test/data/POC2
diff --git a/test/data/POC3 b/test/data/POC3
diff --git a/test/data/POC4 b/test/data/POC4
diff --git a/test/data/POC5 b/test/data/POC5
diff --git a/test/data/POC6 b/test/data/POC6
diff --git a/test/data/POC8 b/test/data/POC8
diff --git a/test/data/POC9 b/test/data/POC9
diff --git a/test/data/bugfixes-test.out b/test/data/bugfixes-test.out
diff --git a/test/tiff-test.sh b/test/tiff-test.sh