* Fix heap buffer overflow in EntryParser::Fetch methods
Add buffer bounds validation to indexed Fetch methods that compute
offsets from attacker-controlled EXIF data via GetSubIFD().
Previously, Fetch(uint16_t, idx), Fetch(double), and Fetch(double, idx)
would read from buf at offsets derived from parsed EXIF fields without
checking against the actual buffer length. A crafted JPEG with a
malicious SubjectArea length (tag 0x9214) could trigger a heap buffer
overflow via parse16() reads past the end of the buffer.
Fixes#24
* Fix include directive and simplify Fetch method
* Problem: in MSVC++ UNICODE builds, the _tcsncmp and _tcsicmp defined via <tchar.h> need wchar_t* input, but that's not what we have available here
Solution:
1) in place of _tcsncmp, just use strncmp, which ought to be standard: http://www.cplusplus.com/reference/cstring/strncmp/
2) in place of _tcsicmp, call strcasecmp, and in MSVC++ builds create a wrapper that actually calls _stricmp (and never _wcsicmp)
* #include <string.h> and not <strings.h>
cDc
Paul Gafton
Marco
simfeo
Juha Reunanen
shinji-yoshida