This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new ec42a0aec0 avcodec/exif: avoid overflow with supplemental extra IFDs
ec42a0aec0 is described below
commit ec42a0aec0069371f55ff6cbcd05269502018e3f
Author: Leo Izen <[email protected]>
AuthorDate: Sat Jan 3 11:31:21 2026 -0500
Commit: Leo Izen <[email protected]>
CommitDate: Wed Jan 7 04:01:51 2026 -0500
avcodec/exif: avoid overflow with supplemental extra IFDs
If extra IFDs occur outside of the top level, we don't allocate enough
buffer space for them. This commit changes our calculation to include
their size always, and then we shrink the allocated buffer once every
IFD is written (by at most 192 bytes).
Signed-off-by: Leo Izen <[email protected]>
---
libavcodec/exif.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/libavcodec/exif.c b/libavcodec/exif.c
index 5ce402784c..01ffa88194 100644
--- a/libavcodec/exif.c
+++ b/libavcodec/exif.c
@@ -673,9 +673,7 @@ static size_t exif_get_ifd_size(const AVExifMetadata *ifd)
for (size_t i = 0; i < ifd->count; i++) {
const AVExifEntry *entry = &ifd->entries[i];
if (entry->type == AV_TIFF_IFD) {
- /* this is an extra IFD, not an entry, so we don't need to add
base tag size */
- size_t base_size = entry->id > 0xFFECu && entry->id <= 0xFFFCu ? 0
: BASE_TAG_SIZE;
- total_size += base_size + exif_get_ifd_size(&entry->value.ifd) +
entry->ifd_offset;
+ total_size += BASE_TAG_SIZE + exif_get_ifd_size(&entry->value.ifd)
+ entry->ifd_offset;
} else {
size_t payload_size = entry->count * exif_sizes[entry->type];
total_size += BASE_TAG_SIZE + (payload_size > 4 ? payload_size :
0);
@@ -776,11 +774,10 @@ int av_exif_write(void *logctx, const AVExifMetadata
*ifd, AVBufferRef **buffer,
headsize = 0;
break;
}
- buf = av_buffer_alloc(size + off + headsize);
- if (!buf) {
- ret = AVERROR(ENOMEM);
+
+ ret = av_buffer_realloc(&buf, size + off + headsize);
+ if (ret < 0)
goto end;
- }
if (header_mode == AV_EXIF_EXIF00) {
AV_WL32(buf->data, MKTAG('E','x','i','f'));
@@ -853,6 +850,12 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd,
AVBufferRef **buffer,
next += ret;
}
+ /* shrink the buffer to the amount of data we actually used */
+ /* extras don't contribute the initial BASE_TAG_SIZE each */
+ ret = av_buffer_realloc(&buf, buf->size - BASE_TAG_SIZE * extras);
+ if (ret < 0)
+ goto end;
+
*buffer = buf;
ret = 0;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
