@@ -1534,7 +1534,6 @@ namespace Exiv2 {
15341534 return ;
15351535 }
15361536 p += 4 ;
1537- uint32_t isize= 0 ; // size of Exif.Sony1.PreviewImage
15381537
15391538 if (count > std::numeric_limits<uint32_t >::max () / typeSize) {
15401539 throw Error (kerArithmeticOverflow);
@@ -1547,7 +1546,19 @@ namespace Exiv2 {
15471546 || static_cast <int32_t >(baseOffset ()) + offset <= 0 )) {
15481547 // #1143
15491548 if ( object->tag () == 0x2001 && std::string (groupName (object->group ())) == " Sony1" ) {
1550- isize=size;
1549+ // This tag is Exif.Sony1.PreviewImage, which refers to a preview image which is
1550+ // not stored in the metadata. Instead it is stored at the end of the file, after
1551+ // the main image. The value of `size` refers to the size of the preview image, not
1552+ // the size of the tag's payload, so we set it to zero here so that we don't attempt
1553+ // to read those bytes from the metadata. We currently leave this tag as "undefined",
1554+ // although we may attempt to handle it better in the future. More discussion of
1555+ // this issue can be found here:
1556+ //
1557+ // https://github.com/Exiv2/exiv2/issues/2001
1558+ // https://github.com/Exiv2/exiv2/pull/2008
1559+ // https://github.com/Exiv2/exiv2/pull/2013
1560+ typeId = undefined;
1561+ size = 0 ;
15511562 } else {
15521563#ifndef SUPPRESS_WARNINGS
15531564 EXV_ERROR << " Offset of directory " << groupName (object->group ())
@@ -1595,18 +1606,7 @@ namespace Exiv2 {
15951606 }
15961607 Value::UniquePtr v = Value::create (typeId);
15971608 enforce (v.get () != nullptr , kerCorruptedMetadata);
1598- if ( !isize ) {
1599- v->read (pData, size, byteOrder ());
1600- } else {
1601- // Prevent large memory allocations: https://github.com/Exiv2/exiv2/issues/1881
1602- enforce (isize <= 1024 * 1024 , kerCorruptedMetadata);
1603-
1604- // #1143 Write a "hollow" buffer for the preview image
1605- // Sadly: we don't know the exact location of the image in the source (it's near offset)
1606- // And neither TiffReader nor TiffEntryBase have access to the BasicIo object being processed
1607- std::vector<byte> buffer (isize);
1608- v->read (buffer.data () ,isize, byteOrder ());
1609- }
1609+ v->read (pData, size, byteOrder ());
16101610
16111611 object->setValue (std::move (v));
16121612 object->setData (pData, size);
0 commit comments