exif/heic: Ensure file is at least 16 bytes to prevent underflow

ndossche · ndossche · commit f4c2a1005458 · 2025-09-13T11:44:20.000+02:00
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
@@ -4509,7 +4509,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)
 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
 				return false;
 			}
-		} else if ((ImageInfo->FileSize > 12) &&
+		} else if ((ImageInfo->FileSize > 16) &&
 			   (!memcmp(file_header + 4, "ftyp", 4)) &&
 			   (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&
 			   ((!memcmp(file_header + 8, "heic", 4)) || (!memcmp(file_header + 8, "heix", 4)) || (!memcmp(file_header + 8, "mif1", 4)))) {

Original file line number	Diff line number	Diff line change
`@@ -4509,7 +4509,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)`
`4509`	`4509`	`exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");`
`4510`	`4510`	`return false;`
`4511`	`4511`	`}`
`4512`		`- } else if ((ImageInfo->FileSize > 12) &&`
	`4512`	`+ } else if ((ImageInfo->FileSize > 16) &&`
`4513`	`4513`	`(!memcmp(file_header + 4, "ftyp", 4)) &&`
`4514`	`4514`	`(exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&`
`4515`	`4515`	`((!memcmp(file_header + 8, "heic", 4)) \|\| (!memcmp(file_header + 8, "heix", 4)) \|\| (!memcmp(file_header + 8, "mif1", 4)))) {`