summaryrefslogtreecommitdiff
path: root/src/lib/emile
diff options
context:
space:
mode:
authorJaeun Choi <jaeun12.choi@samsung.com>2017-04-06 15:34:53 +0900
committerJaeun Choi <jaeun12.choi@samsung.com>2017-04-06 15:34:53 +0900
commit53e31eeede51bba866b6224bb4ac030693e744a8 (patch)
treeff1876fcc8132d629458309f5a81be94b92eaeed /src/lib/emile
parentc3372a5c7a59a2a7f872ef81d9816d37f2536c36 (diff)
emile_image: add error handling code for ifd_offset value
Signed-off-by: JEONGHYUN YUN <jh0506.yun@samsung.com>
Diffstat (limited to 'src/lib/emile')
-rw-r--r--src/lib/emile/emile_image.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/src/lib/emile/emile_image.c b/src/lib/emile/emile_image.c
index b342e3e8be..309dbbb999 100644
--- a/src/lib/emile/emile_image.c
+++ b/src/lib/emile/emile_image.c
@@ -933,6 +933,10 @@ _get_orientation_app1(const unsigned char *map,
933 { 933 {
934 // get 4byte by little endian 934 // get 4byte by little endian
935 ifd_offset += (*(buf + 14) << 24) + (*(buf + 15) << 16) + (*(buf + 16) << 8) + (*(buf + 17)); 935 ifd_offset += (*(buf + 14) << 24) + (*(buf + 15) << 16) + (*(buf + 16) << 8) + (*(buf + 17));
936
937 if (ifd_offset > fsize)
938 return EINA_FALSE;
939
936 byte_align = EXIF_BYTE_ALIGN_MM; 940 byte_align = EXIF_BYTE_ALIGN_MM;
937 num_directory = ((*(buf + ifd_offset) << 8) + *(buf + ifd_offset + 1)); 941 num_directory = ((*(buf + ifd_offset) << 8) + *(buf + ifd_offset + 1));
938 orientation[0] = 0x01; 942 orientation[0] = 0x01;
@@ -942,6 +946,10 @@ _get_orientation_app1(const unsigned char *map,
942 { 946 {
943 // get 4byte by big endian 947 // get 4byte by big endian
944 ifd_offset += (*(buf + 14)) + (*(buf + 15) << 8) + (*(buf + 16) << 16) + (*(buf + 17) << 24); 948 ifd_offset += (*(buf + 14)) + (*(buf + 15) << 8) + (*(buf + 16) << 16) + (*(buf + 17) << 24);
949
950 if (ifd_offset > fsize)
951 return EINA_FALSE;
952
945 byte_align = EXIF_BYTE_ALIGN_II; 953 byte_align = EXIF_BYTE_ALIGN_II;
946 num_directory = ((*(buf + ifd_offset + 1) << 8) + *(buf + ifd_offset)); 954 num_directory = ((*(buf + ifd_offset + 1) << 8) + *(buf + ifd_offset));
947 orientation[0] = 0x12; 955 orientation[0] = 0x12;