Resize buffer to avoid overflow in QuickTimeVideo::userDataDecoder

src/quicktimevideo.cpp

@@ -797,13 +797,13 @@ void QuickTimeVideo::userDataDecoder(size_t size_external) {
 
   const long bufMinSize = 100;
   DataBuf buf(bufMinSize);
-  size_t size = 0, size_internal = size_external;
+  size_t size_internal = size_external;
   std::memset(buf.data(), 0x0, buf.size());
 
   while ((size_internal / 4 != 0) && (size_internal > 0)) {
     buf.data()[4] = '\0';
     io_->readOrThrow(buf.data(), 4);
-    size = buf.read_uint32(0, bigEndian);
+    const size_t size = buf.read_uint32(0, bigEndian);
     if (size > size_internal)
       break;
     size_internal -= size;
@@ -845,8 +845,14 @@ void QuickTimeVideo::userDataDecoder(size_t size_external) {
     }
 
     else if (tv) {
+      const size_t tv_size = size - 12;
+      if (tv_size >= buf.size()) {
+        enforce(tv_size <= io_->size() - io_->tell(), Exiv2::ErrorCode::kerCorruptedMetadata);
+        buf.resize(tv_size + 1);
+      }
       io_->readOrThrow(buf.data(), 4);
-      io_->readOrThrow(buf.data(), size - 12);
+      io_->readOrThrow(buf.data(), tv_size);
+      buf.write_uint8(tv_size, 0);  // nul-terminate string
       xmpData_[exvGettext(tv->label_)] = Exiv2::toString(buf.data());
     }
 

tests/bugfixes/github/test_issue_2366.py

@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, check_no_ASAN_UBSAN_errors
+
+class issue_2366_QuickTimeVideo_userDataDecoder_buffer_overflow(metaclass=CaseMeta):
+    url      = "https://github.com/Exiv2/exiv2/issues/2366"
+    filename = "$data_path/issue_2366_poc.mp4"
+    commands = ["$exiv2 $filename"]
+    retval   = [253]
+    stderr   = ["""$filename: No Exif data found in the file
+"""]
+    stdout   = ["""File name       : $filename
+File size       : 159 Bytes
+MIME type       : video/quicktime
+Image size      : 0 x 0
+"""]

tests/regression_tests/test_regression_allfiles.py

@@ -60,6 +60,7 @@ def get_valid_files(data_dir):
         # really need to worry about them here
         "issue_2340_poc.mp4",
         "issue_2345_poc.mp4",
+        "issue_2366_poc.mp4",
         "2018-01-09-exiv2-crash-001.tiff",
         "cve_2017_1000126_stack-oob-read.webp",
         "exiv2-bug1247.jpg",