* Fix integer overflow in parseString bounds check
Cast `base` to `uint64_t` in the parseString bounds check
`base+data+num_components <= len` to prevent unsigned integer overflow.
When `data` is attacker-controlled (e.g. 0xffffffff), the 32-bit
unsigned addition wraps around, causing the check to pass even though
the computed offset is far beyond the buffer. This leads to an
out-of-bounds heap read or segfault when dereferencing the resulting
pointer.
Fixes#16
* Fix type casting for base pointer comparison
* Fix heap buffer overflow in EntryParser::Fetch methods
Add buffer bounds validation to indexed Fetch methods that compute
offsets from attacker-controlled EXIF data via GetSubIFD().
Previously, Fetch(uint16_t, idx), Fetch(double), and Fetch(double, idx)
would read from buf at offsets derived from parsed EXIF fields without
checking against the actual buffer length. A crafted JPEG with a
malicious SubjectArea length (tag 0x9214) could trigger a heap buffer
overflow via parse16() reads past the end of the buffer.
Fixes#24
* Fix include directive and simplify Fetch method
* Problem: in MSVC++ UNICODE builds, the _tcsncmp and _tcsicmp defined via <tchar.h> need wchar_t* input, but that's not what we have available here
Solution:
1) in place of _tcsncmp, just use strncmp, which ought to be standard: http://www.cplusplus.com/reference/cstring/strncmp/
2) in place of _tcsicmp, call strcasecmp, and in MSVC++ builds create a wrapper that actually calls _stricmp (and never _wcsicmp)
* #include <string.h> and not <strings.h>
cDc
Azamat H. Hackimov
Paul Gafton
Timothy Lyanguzov
Marco
Sebastian Martin Dicke
simfeo
Juha Reunanen
shinji-yoshida