Various fixes to exif/heic support #19745
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nielsdos
force-pushed
the
exif-fixes2
branch
2 times, most recently
from
6f75e1f to
7dcdc1a
Compare
nielsdos
force-pushed
the
exif-fixes2
branch
from
43a3909 to
04d4067
Compare
|
Rebased. |
arnaud-lb
reviewed
Sep 13, 2025
|
Nice catches in the review, thanks! I updated it with the issues (hopefully) fixed. |
It is illegal to construct out-of-bound pointers, even if they are not dereferenced. The current bound checks rely on undefined behaviour. Fix this by introducing convenience macros that check the remaining length.
The loop checks against `p` but increases `p2`. I don't see the point of having 2 separate variables, so use `p` instead to correct the bounds check and simplify the code in the process.
…ile size We change the order of operations such that the file size check cannot overflow in the for loop. This prevents infinite loops. We also add an overflow check at the end of the loop body to prevent the addition of offset and box.size from overflowing.
nielsdos
force-pushed
the
exif-fixes2
branch
from
60a1bed to
b90d65f
Compare
|
Rebased and cleaned up the history. Will merge on green CI. |
|
I just doubled checked this and it all looks good. Nice work. It was really buggy - I didn't do a good job in review apparently - need to do more checking next time. |
|
Well I found few but apparently also missed few as well but good that fuzzer is running on it as some of this would be security issues most likely... |
|
Parsing code tends to be tricky. It's always good to look with a few different people as it's very easy to miss issues. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.