64 lines
2.7 KiB
Diff
64 lines
2.7 KiB
Diff
From a4cbc451f204b8e69d1ac843f8042dea10251397 Mon Sep 17 00:00:00 2001
|
|
From: yangcheng1203 <yangcheng87@huawei.com>
|
|
Date: Mon, 26 Jul 2021 17:00:47 +0800
|
|
Subject: [PATCH] CVE-2020-13113
|
|
|
|
---
|
|
libexif/canon/exif-mnote-data-canon.c | 1 +
|
|
libexif/fuji/exif-mnote-data-fuji.c | 1 +
|
|
libexif/olympus/exif-mnote-data-olympus.c | 1 +
|
|
libexif/pentax/exif-mnote-data-pentax.c | 1 +
|
|
4 files changed, 4 insertions(+)
|
|
|
|
diff --git a/libexif/canon/exif-mnote-data-canon.c b/libexif/canon/exif-mnote-data-canon.c
|
|
index eb53598..83854ad 100644
|
|
--- a/libexif/canon/exif-mnote-data-canon.c
|
|
+++ b/libexif/canon/exif-mnote-data-canon.c
|
|
@@ -233,6 +233,7 @@ exif_mnote_data_canon_load (ExifMnoteData *ne,
|
|
tcount = 0;
|
|
for (i = c, o = datao; i; --i, o += 12) {
|
|
size_t s;
|
|
+ memset(&n->entries[tcount], 0, sizeof(MnoteCanonEntry));
|
|
if ((o + 12 < o) || (o + 12 < 12) || (o + 12 > buf_size)) {
|
|
exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
|
|
"ExifMnoteCanon", "Short MakerNote");
|
|
diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
|
|
index 9514654..efcf654 100644
|
|
--- a/libexif/fuji/exif-mnote-data-fuji.c
|
|
+++ b/libexif/fuji/exif-mnote-data-fuji.c
|
|
@@ -195,6 +195,7 @@ exif_mnote_data_fuji_load (ExifMnoteData *en,
|
|
tcount = 0;
|
|
for (i = c, o = datao; i; --i, o += 12) {
|
|
size_t s;
|
|
+ memset(&n->entries[tcount], 0, sizeof(MnoteFujiEntry));
|
|
if ((o + 12 < o) || (o + 12 < 12) || (o + 12 > buf_size)) {
|
|
exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
|
|
"ExifMnoteDataFuji", "Short MakerNote");
|
|
diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
|
|
index 099671d..9bf0855 100644
|
|
--- a/libexif/olympus/exif-mnote-data-olympus.c
|
|
+++ b/libexif/olympus/exif-mnote-data-olympus.c
|
|
@@ -430,6 +430,7 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
|
|
tcount = 0;
|
|
for (i = c, o = o2; i; --i, o += 12) {
|
|
size_t s;
|
|
+ memset(&n->entries[tcount], 0, sizeof(MnoteOlympusEntry));
|
|
if ((o + 12 < o) || (o + 12 < 12) || (o + 12 > buf_size)) {
|
|
exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
|
|
"ExifMnoteOlympus", "Short MakerNote");
|
|
diff --git a/libexif/pentax/exif-mnote-data-pentax.c b/libexif/pentax/exif-mnote-data-pentax.c
|
|
index 757bb72..1de77b8 100644
|
|
--- a/libexif/pentax/exif-mnote-data-pentax.c
|
|
+++ b/libexif/pentax/exif-mnote-data-pentax.c
|
|
@@ -277,6 +277,7 @@ exif_mnote_data_pentax_load (ExifMnoteData *en,
|
|
tcount = 0;
|
|
for (i = c, o = datao; i; --i, o += 12) {
|
|
size_t s;
|
|
+ memset(&n->entries[tcount], 0, sizeof(MnotePentaxEntry));
|
|
if ((o + 12 < o) || (o + 12 < 12) || (o + 12 > buf_size)) {
|
|
exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
|
|
"ExifMnoteDataPentax", "Short MakerNote");
|
|
--
|
|
1.8.3.1
|
|
|