exif/heic: Ensure file is at least 16 bytes to prevent underflow

ndossche · ndossche · commit eba4140bc49f · 2025-09-14T17:29:57.000+02:00
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
@@ -4507,7 +4507,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)
 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
 				return false;
 			}
-		} else if ((ImageInfo->FileSize > 12) &&
+		} else if ((ImageInfo->FileSize > 16) &&
 			   (!memcmp(file_header + 4, "ftyp", 4)) &&
 			   (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&
 			   ((!memcmp(file_header + 8, "heic", 4)) || (!memcmp(file_header + 8, "heix", 4)) || (!memcmp(file_header + 8, "mif1", 4)))) {

Original file line number	Diff line number	Diff line change
`@@ -4507,7 +4507,7 @@ static bool exif_scan_FILE_header(image_info_type *ImageInfo)`
`4507`	`4507`	`exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");`
`4508`	`4508`	`return false;`
`4509`	`4509`	`}`
`4510`		`- } else if ((ImageInfo->FileSize > 12) &&`
	`4510`	`+ } else if ((ImageInfo->FileSize > 16) &&`
`4511`	`4511`	`(!memcmp(file_header + 4, "ftyp", 4)) &&`
`4512`	`4512`	`(exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&`
`4513`	`4513`	`((!memcmp(file_header + 8, "heic", 4)) \|\| (!memcmp(file_header + 8, "heix", 4)) \|\| (!memcmp(file_header + 8, "mif1", 4)))) {`