exif/heic: Ensure file is at least 16 bytes to prevent underflow

ndossche · ndossche · commit 43a39090bed1 · 2025-09-07T11:24:03.000+02:00
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
@@ -4499,7 +4499,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)
 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
 				return false;
 			}
-		} else if ((ImageInfo->FileSize > 12) &&
+		} else if ((ImageInfo->FileSize > 16) &&
 			   (!memcmp(file_header + 4, "ftyp", 4)) &&
 			   (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&
 			   ((!memcmp(file_header + 8, "heic", 4)) || (!memcmp(file_header + 8, "heix", 4)) || (!memcmp(file_header + 8, "mif1", 4)))) {

Original file line number	Diff line number	Diff line change
`@@ -4499,7 +4499,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)`
`4499`	`4499`	`exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");`
`4500`	`4500`	`return false;`
`4501`	`4501`	`}`
`4502`		`- } else if ((ImageInfo->FileSize > 12) &&`
	`4502`	`+ } else if ((ImageInfo->FileSize > 16) &&`
`4503`	`4503`	`(!memcmp(file_header + 4, "ftyp", 4)) &&`
`4504`	`4504`	`(exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&`
`4505`	`4505`	`((!memcmp(file_header + 8, "heic", 4)) \|\| (!memcmp(file_header + 8, "heix", 4)) \|\| (!memcmp(file_header + 8, "mif1", 4)))) {`