rev 6541 - in kde-extras/exiv2/trunk/debian: . patches

[Mark Purcell]

Author: msp
Date: 2007-06-19 11:57:49 +0000 (Tue, 19 Jun 2007)
New Revision: 6541

Added:
   kde-extras/exiv2/trunk/debian/patches/rev-1106.diff
   kde-extras/exiv2/trunk/debian/patches/rev-1124.diff
Modified:
   kde-extras/exiv2/trunk/debian/changelog
Log:
* DebConf7 release :-)
* Urgency medium as this fixes a number of crashes in digikam et al
* Pull in upstream fixes for jpeg/tiff MSC makernote crashes
  (rev 1106/1124)

Modified: kde-extras/exiv2/trunk/debian/changelog
===================================================================
--- kde-extras/exiv2/trunk/debian/changelog	2007-06-18 23:40:50 UTC (rev 6540)
+++ kde-extras/exiv2/trunk/debian/changelog	2007-06-19 11:57:49 UTC (rev 6541)
@@ -1,8 +1,11 @@
-exiv2 (0.14-2) UNRELEASED; urgency=low
+exiv2 (0.14-2) unstable; urgency=medium
 
-  * NOT RELEASED YET
+  * DebConf7 release :-)
+  * Urgency medium as this fixes a number of crashes in digikam et al
+  * Pull in upstream fixes for jpeg/tiff MSC makernote crashes
+    (rev 1106/1124)
 
- -- Mark Purcell <msp at debian.org>  Wed, 09 May 2007 22:46:24 +0100
+ -- Mark Purcell <msp at debian.org>  Tue, 19 Jun 2007 12:55:55 +0100
 
 exiv2 (0.14-1) unstable; urgency=low
 

Added: kde-extras/exiv2/trunk/debian/patches/rev-1106.diff
===================================================================
--- kde-extras/exiv2/trunk/debian/patches/rev-1106.diff	                        (rev 0)
+++ kde-extras/exiv2/trunk/debian/patches/rev-1106.diff	2007-06-19 11:57:49 UTC (rev 6541)
@@ -0,0 +1,25 @@
+--- trunk/src/ifd.cpp	2007/04/20 16:05:17	1105
++++ trunk/src/ifd.cpp	2007/04/30 15:57:23	1106
+@@ -356,7 +356,21 @@
+                 pe.tag_ = getUShort(buf + o, byteOrder);
+                 pe.type_ = getUShort(buf + o + 2, byteOrder);
+                 pe.count_ = getULong(buf + o + 4, byteOrder);
+-                pe.size_ = pe.count_ * TypeInfo::typeSize(TypeId(pe.type_));
++                uint32_t ts = TypeInfo::typeSize(TypeId(pe.type_));
++                if (pe.count_ >= 0x10000000 && ts != 0) {
++                    if (pe.count_ >= 0x80000000 / ts) {
++#ifndef SUPPRESS_WARNINGS
++                        std::cerr << "Warning: "
++                                  << ExifTags::ifdName(ifdId_) << " tag 0x"
++                                  << std::setw(4) << std::setfill('0') << std::hex
++                                  << pe.tag_ << " has invalid size "
++                                  << std::dec << pe.count_ << "*" << ts 
++                                  << "; truncating the data.\n";
++#endif
++                        pe.count_ = 0;
++                    }
++                }
++                pe.size_ = pe.count_ * ts;
+                 pe.offsetLoc_ = o + 8 - shift;
+                 pe.offset_ = pe.size_ > 4 ? getLong(buf + o + 8, byteOrder) : 0;
+                 preEntries.push_back(pe);

Added: kde-extras/exiv2/trunk/debian/patches/rev-1124.diff
===================================================================
--- kde-extras/exiv2/trunk/debian/patches/rev-1124.diff	                        (rev 0)
+++ kde-extras/exiv2/trunk/debian/patches/rev-1124.diff	2007-06-19 11:57:49 UTC (rev 6541)
@@ -0,0 +1,22 @@
+--- branches/exiv2-tiffparser/src/tiffvisitor.cpp	2007/02/14 06:15:40	1053
++++ branches/exiv2-tiffparser/src/tiffvisitor.cpp	2007/06/09 15:18:59	1124
+@@ -1047,6 +1047,19 @@
+         }
+         p += 2;
+         object->count_ = getULong(p, byteOrder());
++        if (object->count_ >= 0x10000000 && typeSize != 0) {
++            if (object->count_ >= 0x80000000 / typeSize) {
++#ifndef SUPPRESS_WARNINGS
++                std::cerr << "Error: Directory " << tiffGroupName(object->group())
++                          << ", entry 0x" << std::setw(4)
++                          << std::setfill('0') << std::hex << object->tag()
++                          << " has invalid size "
++                          << std::dec << object->count_ << "*" << typeSize 
++                          << "; skipping entry.\n";
++#endif
++                return;
++            }
++        }
+         p += 4;
+         object->size_ = typeSize * object->count_;
+         object->offset_ = getLong(p, byteOrder());