Changeset 12384

Timestamp:

10/12/07 16:37:55 (9 months ago)

Author:

warmerdam

Message:

avoid crashing given corrupt exif info, better error checking (#1904)

Files:

• sandbox/warmerdam/1.4-esri/gdal/frmts/jpeg/jpgdataset.cpp (modified) (6 diffs)

sandbox/warmerdam/1.4-esri/gdal/frmts/jpeg/jpgdataset.cpp

@@ -397 +397 @@
-/*      Read number of entry in directory                               */
-/* -------------------------------------------------------------------- */
-VSIFSeekL(fp, nOffset+nTIFFHEADER, SEEK_SET);
-
-if(VSIFReadL(&nEntryCount,1,sizeof(GUInt16),fp) != sizeof(GUInt16)) 
+if( VSIFSeekL(fp, nOffset+nTIFFHEADER, SEEK_SET) != 0 
+
+{
-        CPLError( CE_Failure, CPLE_AppDefined,
-
+
+
+
+
-
-    if (bSwabflag)
@@ -410 +413 @@
-        return CE_None;
-
+    // Some files are corrupt, a large entry count is a sign of this.
+    if( nEntryCount > 125 )
+    {
+        CPLError( CE_Warning, CPLE_AppDefined,
+                  "Ignoring EXIF directory with unlikely entry count (%d).",
+                  nEntryCount );
+        return CE_Warning;
+    }
+
-    poTIFFDir = (TIFFDirEntry *)CPLMalloc(nEntryCount * sizeof(TIFFDirEntry));
-
-    if (poTIFFDir == NULL) 
+    {
-        CPLError( CE_Failure, CPLE_AppDefined,
-                  "No space for TIFF directory");
+        return CE_Failure;
+    }
-  
-/* -------------------------------------------------------------------- */
@@ -421 +436 @@
-    n = VSIFReadL(poTIFFDir, 1,nEntryCount*sizeof(TIFFDirEntry),fp);
-    if (n != nEntryCount*sizeof(TIFFDirEntry)) 
+    {
-        CPLError( CE_Failure, CPLE_AppDefined,
-                  "Could not read all directories");
+        return CE_Failure;
+    }
-
-/* -------------------------------------------------------------------- */
@@ -439 +457 @@
-/* -------------------------------------------------------------------- */
-        pszName[0] = '\0';
+        pszTemp[0] = '\0';
-
-        for (poExifTags = tagnames; poExifTags->tag; poExifTags++)
@@ -559 +578 @@
-/*      The data is being read where tdir_offset point to in the file   */
-/* -------------------------------------------------------------------- */
-{
-
+if (space > 0 && space < MAXSTRINGLENGTH) 
+
-            unsigned char *data = (unsigned char *)CPLMalloc(space);
-
@@ -601 +620 @@
-            }
-        }
+        else
+        {
+            CPLError( CE_Warning, CPLE_AppDefined,
+                      "Invalid EXIF header size: %ld, ignoring tag.", space );
+        }
+
-        papszMetadata = CSLSetNameValue(papszMetadata, pszName, pszTemp);
-    }