[SCM] exiv2 packaging branch, master, updated. debian/0.25-3.1-3734-gdcbc29a

[Maximiliano Curia]

Gitweb-URL: http://git.debian.org/?p=pkg-kde/kde-extras/exiv2.git;a=commitdiff;h=dd4faaf

The following commit has been merged in the master branch:
commit dd4faaf831163332e48e233268986a49a2fbab8a
Author: Robin Mills <robin at clanmills.com>
Date:   Tue Feb 14 20:07:12 2017 +0000

    #1277 Fix submitted.  Thank You to Ben for reporting this and providing a patch.
---
 src/image.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/image.cpp b/src/image.cpp
index 70f90d2..cc0d340 100644
--- a/src/image.cpp
+++ b/src/image.cpp
@@ -330,6 +330,11 @@ namespace Exiv2 {
         return result;
     }
 
+    static bool typeValid(uint16_t type)
+    {
+    	return type >= 1 && type <= 13 ;
+    }
+
     void Image::printIFDStructure(BasicIo& io, std::ostream& out, Exiv2::PrintStructureOption option,uint32_t start,bool bSwap,char c,int depth)
     {
         depth++;
@@ -386,6 +391,12 @@ namespace Exiv2 {
                                 : 1
                                 ;
 
+                // Break for unknown tag types else we may get segfault.
+                if ( !typeValid(type) ) {
+                    std::cerr << "invalid type value detected in Image::printIFDStructure:  " << type << std::endl;
+                    break;
+                }
+
                 // if ( offset > io.size() ) offset = 0; // Denial of service?
                 DataBuf  buf(size*count + pad);  // allocate a buffer
                 std::memcpy(buf.pData_,dir.pData_+8,4);  // copy dir[8:11] into buffer (short strings)

-- 
exiv2 packaging