From 841e2929296bddb962e7bdcae1b4e12ffca45d2f Mon Sep 17 00:00:00 2001
From: cDc <cdc.seacave@gmail.com>
Date: Thu, 19 Mar 2026 06:26:24 +0200
Subject: [PATCH] Fix potential heap buffer overflow in EntryParser::Fetch
 methods (#25)

* Fix heap buffer overflow in EntryParser::Fetch methods

Add buffer bounds validation to indexed Fetch methods that compute
offsets from attacker-controlled EXIF data via GetSubIFD().

Previously, Fetch(uint16_t, idx), Fetch(double), and Fetch(double, idx)
would read from buf at offsets derived from parsed EXIF fields without
checking against the actual buffer length. A crafted JPEG with a
malicious SubjectArea length (tag 0x9214) could trigger a heap buffer
overflow via parse16() reads past the end of the buffer.

Fixes #24

* Fix include directive and simplify Fetch method
---
 TinyEXIF.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/TinyEXIF.cpp b/TinyEXIF.cpp
index f39695a..3cf1ed8 100644
--- a/TinyEXIF.cpp
+++ b/TinyEXIF.cpp
@@ -205,7 +205,10 @@ public:
 	bool Fetch(uint16_t& val, uint32_t idx) const {
 		if (!IsShort() || length <= idx)
 			return false;
-		val = parse16(buf + GetSubIFD() + idx*2, alignIntel);
+		const uint32_t offset = GetSubIFD() + idx*2;
+		if (offset + 2 > len)
+			return false;
+		val = parse16(buf + offset, alignIntel);
 		return true;
 	}
 	bool Fetch(uint32_t& val) const {
@@ -229,7 +232,10 @@ public:
 	bool Fetch(double& val, uint32_t idx) const {
 		if (!IsRational() || length <= idx)
 			return false;
-		val = parseRational(buf + GetSubIFD() + idx*8, alignIntel, IsSRational());
+		const uint32_t offset = GetSubIFD() + idx*8;
+		if (offset + 8 > len)
+			return false;
+		val = parseRational(buf + offset, alignIntel, IsSRational());
 		return true;
 	}