Coder Social home page Coder Social logo

exiv2 / exiv2 Goto Github PK

View Code? Open in Web Editor NEW
857.0 29.0 273.0 121.78 MB

Image metadata library and tools

Home Page: http://www.exiv2.org/

License: Other

CMake 1.27% Shell 0.15% C++ 80.09% Batchfile 0.02% Python 17.43% C 0.77% sed 0.01% QMake 0.01% CodeQL 0.01% Meson 0.25%
image-metadata exif-metadata exif-interface exif iptc xmp-metadata xmp iptc-metadata cli

exiv2's Introduction

Codecov OSS-Fuzz Repology Chat
codecov Fuzzing Status Packaging status #exiv2-chat on matrix.org
CI Status:
Release Basic jobs for all platforms Nightly jobs for Linux distributions On PUSH - Linux Special Builds for main branch

Welcome to Exiv2

Exiv2

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata.

Exiv2 Resource Location
Releases and Documentation
Prereleases:
Project Resources
License (GPLv2)
CMake Downloads
https://exiv2.org
https://pre-release.exiv2.org
https://github.com/Exiv2/exiv2
COPYING
https://cmake.org/download/
README.md
README-CONAN.md
README-SAMPLES.md
User Manual. This document
Conan User Manual click here
Sample Code Manual. click here

The file ReadMe.txt in a build bundle describes how to install the library on the platform. ReadMe.txt also documents how to compile and link code on the platform.

TABLE OF CONTENTS

TOC

Building, Installing, Using and Uninstalling Exiv2

You need CMake to configure the Exiv2 project, any C++ compiler implementing the C++ 17 standard and the associated tool chain.

Build, Install, Use Exiv2 on a UNIX-like system

$ cd ~/gnu/github/exiv2                          # Location of the project code
$ cmake -S . -B build -DCMAKE_BUILD_TYPE=Release # Configure the project with CMake
$ cmake --build build                            # Compile the project
$ ctest --test-dir build --verbose               # Run tests
$ sudo cmake --install build                     # Run the install target (install library, public headers, application and CMake files)

This will install the library into the "standard locations". The library will be installed in /usr/local/lib, executables (including the exiv2 command-line program) in /usr/local/bin/ and header files in /usr/local/include/exiv2. The target directory for the installation can be modified by using the CMake option -DCMAKE_INSTALL_PREFIX.

CMake analyzes the project configuration from the source code directory and generates files into the build directory. It generates the project/solution/makefiles required to build the exiv2 library and command line application (and optionally sample applications and test runners). CMake also creates the files exv_conf.h and exiv2lib_export.h which contain compiler directives about the build options you have chosen and the availability of libraries on your machine.

Using the exiv2 command-line program

To execute the exiv2 command line program, you should update your path to search /usr/local/bin/

$ export PATH="/usr/local/bin:$PATH"

You will also need to locate libexiv2 at run time:

$ export LD_LIBRARY_PATH="/usr/local/lib:$LD_LIBRARY_PATH"      # Linux, Cygwin, MinGW/msys2
$ export DYLD_LIBRARY_PATH="/usr/local/lib:$DYLD_LIBRARY_PATH"  # macOS

Uninstall

I don't know why anybody would uninstall Exiv2.

$ cd ~/gnu/github/exiv2  # location of the project code
$ cmake --build build --target uninstall

These commands will run the uninstall target and remove all the files which were installed by the install target. Note that this mechanism is not perfect and it is not able to remove the sub-directories created in the installation path.

TOC

Build and Install Exiv2 with Visual Studio

We recommend to use conan to download the Exiv2 external dependencies on Windows. On other platforms (macOS, Linux and others), traditionally the platform package managers have been used. However, conan can be used in any platform/architecture to bring the project dependencies. These are discussed at Platform Notes. The options to configure and compile the project using Visual Studio are similar to UNIX like systems. See README-CONAN for more information about Conan.

When you build, you may install with the following command.

> cmake --install build

This will create and copy the exiv2 build artefacts to %ProgramFiles%/exiv2. To be able to run the exiv2 command line application from any terminal you should modify your path to include %ProgramFiles%/exiv2/bin.

TOC

Configure the project with the CMake presets

CMake presets (see documentation here) were added recently to the project to ease the CMake configuration process for typical configurations. The presets are defined in the file CMakePresets.json and they can be used from the terminal or interpreted by different IDEs. Please note that one needs to use a recent version of CMake (>= 3.21) supporting the presets feature.

One can list the available presets using the --list-presets option:

# Running the command from a Windows terminal
$ cmake --list-presets
Available configure presets:

  "msvc"        - Visual Studio cl toolchain (also usable from VS Code)
  "win-debug"   - Windows Debug with configured architecture
  "win-release" - Windows Release with configured architecture

# Running the command from a Linux terminal
$ cmake --list-presets
Available configure presets:

  "linux-debug"   - Linux Debug with default architecture
  "linux-release" - Linux Release with default architecture

The project configuration with a specific preset can be chosen with the CMake --preset option. In the following terminal output we comment out some interesting things happening during the project configuration:

# Configuring the project using a preset
$ cmake --preset win-release
Preset CMake variables:

# Note that with the usage of a preset, we pass many different options to CMake.
  BUILD_SHARED_LIBS:BOOL="TRUE"
  CMAKE_BUILD_TYPE="Release"
  CMAKE_INSTALL_PREFIX:PATH="C:/dev/personal/exiv2/build-win-release/install"
  # A build & install directory are configured with the preset
  CONAN_AUTO_INSTALL:BOOL="TRUE"
  EXIV2_BUILD_SAMPLES:BOOL="TRUE"
  EXIV2_BUILD_UNIT_TESTS:BOOL="TRUE"
  EXIV2_ENABLE_BMFF:BOOL="TRUE"
  EXIV2_ENABLE_CURL:BOOL="TRUE"
  EXIV2_ENABLE_NLS:BOOL="FALSE"
  EXIV2_ENABLE_VIDEO:BOOL="TRUE"
  EXIV2_ENABLE_PNG:BOOL="TRUE"
  EXIV2_ENABLE_WEBREADY:BOOL="TRUE"
  EXIV2_TEAM_WARNINGS_AS_ERRORS:BOOL="TRUE"

# Conan can be automatically detected in your system and it is run automatically to bring the
# project dependencies
-- Conan: Detected VS runtime: MD
-- Conan: checking conan executable
-- Conan: Found program C:/dev/envs/conan/Scripts/conan.exe
-- Conan: Version found Conan version 1.47.0
-- Conan executing: C:/dev/envs/conan/Scripts/conan.exe install .. --remote conancenter --build missing --options webready=True --settings arch=x86_64 --settings build_type=Release --settings compiler=Visual Studio --settings compiler.version=17 --settings compiler.runtime=MD
...

# CMake finds the project dependencies which were automatically handled by conan
-- Conan: Using autogenerated FindZLIB.cmake
-- Library zlib found C:/Users/luis/.conan/data/zlib/1.2.11/_/_/package/
-- Conan: Using autogenerated FindCURL.cmake
-- Library libcurl_imp found C:/Users/luis/.conan/data/libcurl/7.79.0/_/_/package/
...

# CMake finish the project configuration and prints a report
-- Install prefix:    C:/dev/personal/exiv2/build-win-release/install
-- ------------------------------------------------------------------
-- CMake Generator:   Ninja
-- CMAKE_BUILD_TYPE:  Release
-- Compiler info: MSVC (C:/Program Files/Microsoft Visual Studio/2022/Professional/VC/Tools/MSVC/14.30.30705/bin/Hostx64/x64/cl.exe) ; version: 19.30.30705.0
-- CMAKE_CXX_STANDARD:17
--  --- Compiler flags ---
-- General:           /DWIN32 /D_WINDOWS /W3 /GR /EHsc
         /MP
         /utf-8
         /WX
-- Extra:
-- Debug:             /MDd /Zi /Ob0 /Ox /Zo
-- Release:           /MD /O2  /DNDEBUG
-- RelWithDebInfo:    /MD /Zi /O2  /DNDEBUG
-- MinSizeRel:        /MD /O1  /DNDEBUG
--  --- Linker flags ---
-- General:           /machine:x64 /WX
-- Debug:             /debug /INCREMENTAL
-- Release:           /INCREMENTAL:NO
-- RelWithDebInfo:    /debug /INCREMENTAL
-- MinSizeRel:        /INCREMENTAL:NO
--
...
-- Build files have been written to: C:/dev/personal/exiv2/build-win-release

Note that the usage of CMake presets allow the project contributors to use the same set of options easily in different environments (using terminal, IDEs or CI).

TOC

Build options

There are two groups of CMake options which are relevant to the project: global CMake options and project specific ones. Here are some of the global options which are particularly useful:

Options Purpose (default)
CMAKE_INSTALL_PREFIX
CMAKE_BUILD_TYPE
BUILD_SHARED_LIBS
Where to install on your computer (/usr/local)
Type of build (Release) See: Debugging Exiv2
Build exiv2lib as SHARED or STATIC

Options defined at exiv2/CMakeLists.txt include:

576 rmills@rmillsmm:~/gnu/github/exiv2/exiv2 $ grep ^option CMakeLists.txt
option( BUILD_SHARED_LIBS          "Build exiv2lib as a shared library"              ON  )
option( EXIV2_ENABLE_XMP           "Build with XMP metadata support"                 ON  )
option( EXIV2_ENABLE_EXTERNAL_XMP  "Use external version of XMP"                     OFF )
option( EXIV2_ENABLE_PNG           "Build with png support (requires libz)"          ON  )
...
option( EXIV2_ENABLE_BMFF          "Build with BMFF support (brotli recommended)"    ON  )
option( EXIV2_ENABLE_BROTLI        "Use Brotli for JPEG XL compressed boxes (BMFF)"  ON  )
option( EXIV2_ENABLE_FILESYSTEM_ACCESS     "Build with filesystem access"            ON  )
577 rmills@rmillsmm:~/gnu/github/exiv2/exiv2 $

Using the command-line, these variables can be set/updated using the option -D:

$ cmake -DBUILD_SHARED_LIBS=ON -DEXIV2_ENABLE_NLS=OFF

TOC

Dependencies

The following Exiv2 features require external libraries:

Feature Package Default To change default Availability
PNG image support zlib ON -DEXIV2_ENABLE_PNG=OFF https://zlib.net/
XMP support expat ON -DEXIV2_ENABLE_XMP=OFF https://libexpat.github.io/
Use Expat 2.2.6 and later
Natural language system gettext OFF -DEXIV2_ENABLE_NLS=ON https://www.gnu.org/software/gettext/
JPEG XL brob support brotli ON -DEXIV2_ENABLE_BROTLI=OFF https://github.com/google/brotli
Character set conversion libiconv Disabled for Visual Studio.
Linked when installed on UNIX like platforms.
https://www.gnu.org/software/libiconv/

On UNIX systems, you may install the dependencies using the distribution's package management system. Install the development package of a dependency to install the header files and libraries required to build Exiv2. The script ci/install_dependencies.sh is used to setup the CI images on which we build and test Exiv2. You may find that helpful in setting up your platform dependencies.

Natural language system is discussed in more detail here: Localisation

Notes about different platforms are included here: Platform Notes

You may choose to install dependences with conan. This is supported on all platforms and is especially useful for users of Visual Studio. See README-CONAN for more information.

Libiconv

The library libiconv is used to perform character set encoding in the tags Exif.Photo.UserComment, Exif.GPSInfo.GPSProcessingMethod and Exif.GPSInfo.GPSAreaInformation. This is documented in the exiv2 man page.

CMake will detect libiconv of all UNIX like systems including Linux, macOS, UNIX, Cygwin64 and MinGW/msys2. If you have installed libiconv on your machine, Exiv2 will link and use it.

The library libiconv is a GNU library and we do not recommend using libiconv with Exiv2 when building with Visual Studio.

Exiv2 includes the file cmake/FindIconv.cmake which contains a guard to prevent CMake from finding libiconv when you build with Visual Studio. This was added because of issues reported when Visual Studio attempted to link libiconv libraries installed by Cygwin, or MinGW or gnuwin32. #1250

There are build instructions about Visual Studio in libiconv-1.16/INSTALL.window require you to install Cygwin. There is an article here about building libiconv with Visual Studio. https://www.codeproject.com/Articles/302012/How-to-Build-libiconv-with-Microsoft-Visual-Studio.

If you wish to use libiconv with Visual Studio you will have to build libiconv and remove the "guard" in cmake/FindIconv.cmake. Team Exiv2 will not provide support concerning libiconv and Visual Studio.

TOC

Building and linking your code with Exiv2

There are detailed platform notes about compiling and linking in releasenotes/{platform}/ReadMe.txt

where platform: { CYGWIN | Darwin | Linux | MinGW | msvc | Unix }

In general you need to do the following:

  1. Application code should be written in C++98 and include exiv2 headers:
#include <exiv2/exiv2.hpp>
  1. Compile your C++ code with the directive: -I/usr/local/include

  2. Link your code with libexiv2 using the linker options: -lexiv2 and -L/usr/local/lib

The following is a typical command to build and link with libexiv2:

$ g++ -std=c++17 myprog.cpp -o myprog -I/usr/local/include -L/usr/local/lib -lexiv2

TOC

Consuming Exiv2 with CMake

When exiv2 is installed, the files required to consume Exiv2 with CMake are installed in ${CMAKE_INSTALL_PREFIX}/lib/cmake/exiv2

You can build samples/exifprint.cpp as follows:

$ cd <exiv2dir>
$ mkdir exifprint
$ cd    exifprint
$ cat - > CMakeLists.txt <<EOF
cmake_minimum_required(VERSION 3.11)
project(exifprint VERSION 0.0.1 LANGUAGES CXX)

set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_EXTENSIONS OFF)

find_package(exiv2 REQUIRED CONFIG NAMES exiv2)    # search ${CMAKE_INSTALL_PREFIX}/lib/cmake/exiv2/
add_executable(exifprint ../samples/exifprint.cpp) # Create exifprint target
target_link_libraries(exifprint PRIVATE Exiv2::exiv2lib)  # link exiv2lib
EOF
$ cmake .                                          # generate the makefile
$ cmake --build .                                  # build the code
$ ./exifprint                                      # test your executable
Usage: bin/exifprint [ path | --version | --version-test ]
$

TOC

Using pkg-config to compile and link your code with Exiv2

When exiv2 is installed, the file exiv2.pc used by pkg-config is installed in ${CMAKE_INSTALL_PREFIX}/lib/pkgconfig You will need to set the following in your environment:

$ export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH"

To compile and link using exiv2.pc, you usually add the following to your Makefile.

PKGCONFIG=pkg-config
CPPFLAGS := `pkg-config exiv2 --cflags`
LDFLAGS := `pkg-config exiv2 --libs`

If you are not using make, you can use pkg-config as follows:

g++ -std=c++17 myprogram.cpp -o myprogram $(pkg-config exiv2 --libs --cflags)

TOC

Localisation

Localisation is supported on a UNIX-like platform: Linux, macOS, Cygwin and MinGW/msys2. Localisation is not supported for Visual Studio builds.

Crowdin have provided Exiv2 with a free open-source license to use their services. The Exiv2 localisation project is located at https://crowdin.com/project/exiv2. You will also need to register to have a free user account on Crowdin. The Crowdin setup is discussed here: #1510. It is recommended that you coordinate with Leonardo before contributing localisation changes on Crowdin. You can contact Leonardo by via GitHub.

To build localisation support, use the CMake option -DEXIV2_ENABLE_NLS=ON. You must install the gettext package with your package manager or from source. The gettext package is available from https://www.gnu.org/software/gettext/ and includes the library libintl and utilities to build localisation files. If CMake produces error messages which mention libintl or gettext, you should verify that the package gettext has been correctly built and installed.

You must install the build to test localisation. This ensures that the localisation message files can be found at run-time. You cannot test localisation in the directory build\bin.

  1. Running exiv2 in another language
$ env LANG=fr_FR exiv2    # env LANGUAGE=fr_FR exiv2 on Linux!
exiv2: Une action doit être spécifié
exiv2: Au moins un fichier est nécessaire
Utilisation : exiv2 [ option [ arg ] ]+ [ action ] fichier ...

Image metadata manipulation tool.
$
  1. Adding additional languages to exiv2

To support a new language which we'll designate 'xy' for this discussion:

2.1) Generate a po file from the po template:

$ cd <exiv2dir>
$ mkdir -p po/xy
$ msginit --input=po/exiv2.pot --locale=xy --output=po/xy.po

2.2) Edit/Translate the strings in po/xy.po

I edited the following:

#: src/exiv2.cpp:237
msgid "Image metadata manipulation tool.\n"
msgstr ""

to:

#: src/exiv2.cpp:237
msgid "Image metadata manipulation tool.\n"
msgstr "Manipulate image metadata.\n"

2.3) Generate the messages file:

$ mkdir -p             po/xy/LC_MESSAGES
$ msgfmt --output-file=po/xy/LC_MESSAGES/exiv2.mo po/xy.po

2.4) Install and test your messages:

You have to install your messages to test them. It's not possible to test a messages file by executing build/bin/exiv2.

$ sudo mkdir -p                          /usr/local/share/locale/xy/LC_MESSAGES
$ sudo cp -R  po/xy/LC_MESSAGES/exiv2.mo /usr/local/share/locale/xy/LC_MESSAGES
$ env LANG=xy exiv2                      # env LANGUAGE=xy on Linux!
exiv2: An action must be specified
exiv2: At least one file is required
Usage: exiv2 [ option [ arg ] ]+ [ action ] file ...

Manipulate image metadata.   <--------- Edited message!
$

2.5) Submitting your new language file for inclusion in future versions of Exiv2:

You may submit a PR which contains po/xy.po AND a modification to po/CMakeLists.txt

Or, open a new issue on https://github.com/exiv2/exiv2 and attach the file xy.po.zip which can be created as follows:

$ zip xy.po.zip po/xy.po
  adding: po/xy.po (deflated 78%)
ls -l xy.po.zip
-rw-r--r--+ 1 rmills  staff  130417 25 Jun 10:15 xy.po.zip
$

TOC

Building Exiv2 Documentation

Building documentation requires installing special tools. You will probably prefer to read the documentation on-line from the project website: https://exiv2.org

To build documentation, use the CMake option -DEXIV2_BUILD_DOC=ON. Additionally, you will require an additional build step to actually build the documentation.

$ cmake ..options.. -DEXIV2_BUILD_DOC=ON
$ cmake --build build --target doc

To build the documentation, you must install the following products:

Product Availability
doxygen
graphviz
python
xsltproc
md5sum
https://www.doxygen.nl/
https://www.graphviz.org/
https://www.python.org/
http://xmlsoft.org/XSLT/
http://www.microbrew.org/tools/md5sha1sum/

TOC

Building Exiv2 Tag Webpages

Exiv2 provides many built-in metadata tags which are listed in the sub-pages of https://exiv2.org/metadata.html and https://pre-release.exiv2.org/metadata.html. Those tag webpages are generated using tag information extracted from the Exiv2 source code.

The tag webpage build files are in the <exiv2dir>/doc/templates directory. If changes are made to tag groups in the Exiv2 source code then the build files need to be updated. Any changes made to individual tags in an existing tag group are automatically included.

Building the tag webpages requires building the Exiv2 sample programs and using scripts which have additional dependencies on BASH, make, xsltproc and Python3.

To build the tag webpages, first build Exiv2 from source with the -DEXIV2_BUILD_SAMPLES=ON option enabled. This is required as the taglist sample program is used by one of the scripts.

Next, set the EXIV2_BINDIR environment variable (see Exiv2 environment variables).

Then, change directory to doc/templates and run make.

$ cd <exiv2dir>/doc/templates
$ make

After processing, the generated webpages are stored in the <exiv2dir>/doc/templates directory. When the Exiv2 websites are updated, the generated tag webpages are reformatted before use.

TOC

Building Exiv2 Packages

To enable the building of Exiv2 packages, use the CMake option -DEXIV2_TEAM_PACKAGING=ON.

You should not build Exiv2 Packages. This feature is intended for use by Team Exiv2 to create Platform and Source Packages on the buildserver.

There are two types of Exiv2 packages which are generated by cpack from the CMake command-line.

  1. Platform Package (header files, binary library and samples. Some documentation and release notes)

Create and build exiv2 for your platform.

$ git clone https://github.com/exiv2/exiv2
$ cd exiv2
$ cmake -S . -B build -G "Unix Makefiles" -DEXIV2_TEAM_PACKAGING=ON
...
-- Build files have been written to: .../build
$ cmake --build build --config Release
...
[100%] Built target addmoddel
$ cmake --build build --target package
...
CPack: - package: /path/to/exiv2/build/exiv2-0.27.1-Linux.tar.gz generated.
  1. Source Package
$ cmake --build build --target package_source
Run CPack packaging tool for source...
...
CPack: - package: /path/to/exiv2/build/exiv2-0.27.1-Source.tar.gz generated.

TOC

Debugging Exiv2

  1. Generating and installing a debug library

In general to generate a debug library, you should use the CMake option -DCMAKE_RELEASE_TYPE=Debug and build in the usual way.

$ cd <exiv2dir>
$ cmake -S . -B build -G "Unix Makefiles" "-DCMAKE_BUILD_TYPE=Debug"
$ cmake --build build

You must install the library to ensure that your code is linked to the debug library.

You can check that you have generated a debug build with the command:

$ exiv2 -vVg debug
exiv2 0.27.1
debug=1
$
  1. About preprocessor symbols NDEBUG and EXIV2_DEBUG_MESSAGES

Exiv2 respects the symbol NDEBUG which is set only for Release builds. There are sequences of code which are defined within:

#ifdef EXIV2_DEBUG_MESSAGES
....
#endif

Those blocks of code are not compiled unless you define EXIV2_DEBUG_MESSAGES. They are provided for additional debugging information. For example, if you are interested in additional output from webpimage.cpp, you can update your build as follows:

$ cd <exiv2dir>
$ cmake -S . -B build -DCMAKE_CXX_FLAGS=-DEXIV2_DEBUG_MESSAGES
$ cmake --build build
$ bin/exiv2 ...
-- or --
$ cmake --install build
$ exiv2     ...

If you are debugging library code, it is recommended that you use the exiv2 command-line program as your test harness as Team Exiv2 is very familiar with this tool and able to give support.

  1. Starting the debugger

This is platform specific. On Linux:

$ gdb exiv2
  1. Using Debugger IDEs such as Xcode, CLion, Visual Studio, Eclipse or QtCreator

I have used all those IDEs to debug the Exiv2 library and applications. All of them work. You may find it takes initial effort, however I assure you that they all work well.

I work on macOS and use Xcode to develop Exiv2. For a couple of years, Team Exiv2 had free open-source licences from JetBrains for CLion. I really liked CLion as it is cross platform and runs on Windows, Mac and Linux. It has excellent integration with CMake and will automatically add -DCMAKE_BUILD_TYPE=Debug to the CMake command. It keeps build types in separate directories such as <exiv2dir>/cmake-build-debug.

  1. cmake --build build options --config Release|Debug and --target install

Visual Studio and Xcode can build debug or release builds without using the option -DCMAKE_BUILD_TYPE because the generated project files can build multiple types. The option --config Debug can be specified on the CMake command-line to specify the build type. Alternatively, if you prefer to build in the IDE, the UI provides options to select the configuration and target.

With the Unix Makefile generator, the targets can be listed:

$ cmake --build build --target help
The following are some of the valid targets for this Makefile:
... all (the default if no target is provided)
... clean
... depend
... install/local
.........

TOC

Building Exiv2 with clang and other build chains

  1. On Linux
$ cd <exiv2dir>
$ rm -rf build
$ cmake -S . -B build -DCMAKE_C_COMPILER=$(which clang) -DCMAKE_CXX_COMPILER=$(which clang++)
$ cmake --build build

OR

$ export CC=$(which clang)
$ export CXX=$(which clang++)
$ cd <exiv2dir>
$ rm -rf build
$ cmake -S . -B build
$ cmake --build build
  1. On macOS

Apple provide clang with Xcode. GCC has not been supported by Apple since 2013. The "normal unix build" uses Clang.

  1. On Cygwin, MinGW/msys2, Windows (using clang-cl) and Visual Studio.

I have been unable to get clang to work on any of those platforms.

TOC

Building Exiv2 with ccache

To speed up compilation, the utility ccache can be installed to cache the output of the compiler. This greatly speeds up the build when you frequently built code that has not been modified.

Installing and using ccache (and other similar utilities), is platform dependent. On Ubuntu:

$ sudo apt install --yes ccache

To build with ccache, use the CMake option -DBUILD_WITH_CCACHE=ON

$ cd <exiv2dir>
$ cmake -S . -B build -G "Unix Makefiles" -DBUILD_WITH_CCACHE=ON
$ cmake --build build
# Build again to appreciate the performance gain
$ cmake --build build --target clean
$ cmake --build build

Due to the way in which ccache is installed in Fedora (and other Linux distros), ccache effectively replaces the compiler. A default build or -DBUILD_WITH_CCACHE=OFF is not effective and the environment variable CCACHE_DISABLE is required to disable ccache. #361

TOC

Thread Safety

Exiv2 heavily relies on standard C++ containers. Static or global variables are used read-only, with the exception of the XMP namespace registration function (see below). Thus Exiv2 is thread safe in the same sense as C++ containers: Different instances of the same class can safely be used concurrently in multiple threads.

In order to use the same instance of a class concurrently in multiple threads the application must serialize all write access to the object.

The level of thread safety within Exiv2 varies depending on the type of metadata: The Exif and IPTC code is reentrant. The XMP code uses the Adobe XMP toolkit (XMP SDK), which according to its documentation is thread-safe. It actually uses mutexes to serialize critical sections. However, the XMP SDK initialisation function is not mutex protected, thus Exiv2::XmpParser::initialize is not thread-safe. In addition, Exiv2::XmpProperties::registerNs writes to a static class variable, and is also not thread-safe.

Therefore, multi-threaded applications need to ensure that these two XMP functions are serialized, e.g., by calling them from an initialization section which is run before any threads are started. All exiv2 sample applications begin with:

#include <exiv2/exiv2.hpp>
int main(int argc, const char* argv[])
{
    Exiv2::XmpParser::initialize();
    ::atexit(Exiv2::XmpParser::terminate);
#ifdef EXV_ENABLE_BMFF
    Exiv2::enableBMFF(true);
#endif
    ...
}

The use of the thread unsafe function Exiv2::enableBMFF(true) is discussed in Support for BMFF files (e.g., CR3, HEIF, HEIC, AVIF, and JPEG XL)

TOC

Library Initialisation and Cleanup

As discussed in the section on Thread Safety, Exiv2 classes for Exif and IPTC metadata are fully reentrant and require no initialisation or cleanup.

Adobe's XMPsdk is generally thread-safe, however it has to be initialized and terminated before and after starting any threads to access XMP metadata. The Exiv2 library will initialize this if necessary, however it does not terminate the XMPsdk.

The exiv2 command-line program and sample applications call the following at the outset:

    Exiv2::XmpParser::initialize();
    ::atexit(Exiv2::XmpParser::terminate);
#ifdef EXV_ENABLE_BMFF
    Exiv2::enableBMFF(true);
#endif

TOC

Cross Platform Build and Test on Linux for MinGW

You can cross compile Exiv2 on Linux for MinGW. We have used the following method on Fedora and believe this is also possible on Ubuntu and other distros. Detailed instructions are provided here for Fedora.

Cross Build and Test On Fedora

1 Install the cross platform build tools

$ sudo dnf install mingw64-gcc-c++ mingw64-filesystem mingw64-expat mingw64-zlib cmake make

2 Install Dependencies

You will need to install x86_64 libraries to support the options you wish to use. By default, you will need libz and expat. Your dnf command above has installed them for you. If you wish to use features such as webready you should install openssl and libcurl as follows:

[rmills@rmillsmm-fedora 0.27-maintenance]$ sudo yum install libcurl.x86_64 openssl.x86_64
Last metadata expiration check: 0:00:18 ago on Fri 10 Apr 2020 10:50:30 AM BST.
Dependencies resolved.
=========================
Package                          Architecture                                        Version                                                      Repository                       Size
=========================
Installing:
...

3 Get the code and build

$ git clone://github.com/exiv2/exiv2 --branch 0.27-maintenance exiv2
$ cd exiv2
$ mkdir build_mingw_fedora
$ mingw64-cmake ..
$ make

Note, you may wish to choose to build with optional features and/or build static libraries. To do this, request appropriately on the mingw64-cmake command:

$ mingw64-cmake .. -DEXIV2_TEAM_EXTRA_WARNINGS=ON \
                   -DEXIV2_ENABLE_WEBREADY=ON     \
                   -DBUILD_SHARED_LIBS=OFF

The options available for cross-compiling are the same as provided for all builds. See: Build Options

4 Copy "system dlls" in the bin directory

These DLLs are required to execute the cross-platform build in the bin from Windows

for i in libexpat-1.dll libgcc_s_seh-1.dll libstdc++-6.dll libwinpthread-1.dll zlib1.dll ; do
    cp -v /usr/x86_64-w64-mingw32/sys-root/mingw/bin/$i bin
done

5 Executing exiv2 in wine

You may wish to use wine to execute exiv2 from the command prompt. To do this:

[rmills@rmillsmm-fedora build_mingw_fedora]$ wine cmd
Microsoft Windows 6.1.7601

Z:\Home\gnu\github\exiv2\main\build_mingw_fedora>bin\exiv2
exiv2: An action must be specified
exiv2: At least one file is required
Usage: exiv2 [ option [ arg ] ]+ [ action ] file ...

Image metadata manipulation tool.

If you have not installed wine, Fedora will offer to install it for you.

6 Running the test suite

On a default wine installation, you are in the MSDOS/cmd.exe prompt. You cannot execute the exiv2 test suite in this environment as you require python3 and MSYS/bash to run the suite.

You should mount the your Fedora exiv2/ directory on a Windows machine on which you have installed MinGW/msys2. You will need python3 and make.

My build machines is a MacMini with VMs for Windows, Fedora and other platforms. On Fedora, I build in a Mac directory which is shared to all VMs.

[rmills@rmillsmm-fedora 0.27-maintenance]$ pwd
/media/psf/Home/gnu/github/exiv2/0.27-maintenance
[rmills@rmillsmm-fedora 0.27-maintenance]$ ls -l build_mingw_fedora/bin/exiv2.exe
-rwxrwxr-x. 1 rmills rmills 754944 Apr 10 07:44 build_mingw_fedora/bin/exiv2.exe
[rmills@rmillsmm-fedora 0.27-maintenance]$

On MinGW/msys2, I can directly access the share:

$ cd //Mac/Home/gnu/github/exiv2/0.27/maintenance/build_mingw_fedora
$ mingw64-ctest

You will find that 3 tests fail at the end of the test suite. It is safe to ignore those minor exceptions.

TOC

Static and Shared Libraries

You can build either static or shared libraries. Both can be linked with either static or shared run-time libraries. You specify the shared/static with the option -BUILD_SHARED_LIBS=ON|OFF You specify the run-time with the option -DEXIV2_ENABLE_DYNAMIC_RUNTIME=ON|OFF. The default for both options default is ON. So you build shared and use the shared libraries which are .dll on Windows (msvc, Cygwin and MinGW/msys), .dylib on macOS and .so on Linux and UNIX.

CMake creates your build artefacts in the directories bin and lib. The bin directory contains your executables and .DLLs. The lib directory contains your static libraries. When you install exiv2, the build artefacts are copied to your system's prefix directory which by default is /usr/local/. If you wish to test and use your build without installing, you will have to set you PATH appropriately. Linux/Unix users should also set LD_LIBRARY_PATH and macOS users should set DYLD_LIBRARY_PATH.

The default build is SHARED/DYNAMIC and this arrangement treats all executables and shared libraries in a uniform manner.

Caution: The following discussion only applies if you are linking to a static version of the exiv2 library. You may get the following error from CMake:

CMake Error at src/CMakeLists.txt:30 (add_library):
Target "my-app-or-library" links to target "Iconv::Iconv" but the target was
not found. Perhaps a find_package() call is missing for an IMPORTED
target, or an ALIAS target is missing?

Be aware that the warning concerning src/CMakeLists.txt:30 (add_library) refers to your file src/CMakeLists.txt. Although exiv2 has statically linked Iconv(), your code also needs to link. You achieve that in your src/CMakeLists.txt with the code:

find_package(Iconv)
if( ICONV_FOUND )
    target_link_libraries( my-app-or-library PRIVATE Iconv::Iconv )
endif()

This is discussed: #1230

TOC

Support for BMFF files (e.g., CR3, HEIF, HEIC, AVIF, and JPEG XL)

Attention is drawn to the possibility that BMFF support may be the subject of patent rights. Exiv2 shall not be held responsible for identifying any or all such patent rights. Exiv2 shall not be held responsible for the legal consequences of the use of this code.

Access to the BMFF code is guarded in two ways. Firstly, you have to build the library with the CMake option: -DEXIV2_ENABLE_BMFF=ON. Secondly, the application must enable BMFF support at run-time by calling the following function.

EXIV2API bool enableBMFF(bool enable);

The return value from enableBMFF() is true if the library has been build with BMFF support (CMake option -DEXIV2_ENABLE_BMFF=ON).

Applications may wish to provide a preference setting to enable BMFF support and thereby place the responsibility for the use of this code with the user of the application.

TOC

License and Support

All project resources are accessible from the project website. https://github.com/Exiv2/exiv2

License

Copyright (C) 2004-2023 Exiv2 authors. You should have received a copy of the file COPYING which details the GPLv2 license.

Exiv2 is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Exiv2 program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

TOC

Support

For new bug reports, feature requests and support: Please open an issue in Github. https://github.com/exiv2/exiv2

TOC

Test Suite

You execute the Test Suite using CTest with the command $ ctest --test-dir build.

The build creates 6 tests: bashTests, bugfixTests, lensTests, tiffTests, unitTests and versionTests. You can run all tests or a subset. To list all available tests, execute ctest with the -N or --show-only option, which disables execution:

.../exiv2/ $ ctest --test-dir build --show-only
Test project ...main/exiv2
  Test #1: bashTests
  Test #2: bugfixTests
  Test #3: lensTests
  Test #4: tiffTests
  Test #5: versionTests
  Test #6: unitTests

Total Tests: 6
.../exiv2 $

ctest provides many option and the following show common use-case scenarios:

$ ctest --test-dir build                             # run all tests and display summary
$ ctest --test-dir build --output-on-failure         # run all tests and output failures
$ ctest --test-dir build-R bugfix                    # run only bugfixTests and display summary
$ ctest --test-dir build -R bugfix --verbose         # run only bugfixTests and display all output

Except for the unitTests, CMake needs to find a python3 interpreter in the system to be able to run the rest of the test targets with CTest:

Name Language Location Command
(in build directory)
CMake Option to Build
bashTests python tests/bash_tests $ ctest -R bash -DEXIV2_BUILD_SAMPLES=ON
bugfixTests python tests/bugfixes $ ctest -R bugfix -DEXIV2_ENBALE_VIDEO=ON
lensTest C++ tests/lens_tests $ ctest -R lens
tiffTests python tests/tiff_test $ ctest -R tiff
unitTests C++ unitTests/ $ ctest -R unit -DEXIV2_BUILD_UNIT_TESTS=ON
versionTests C++ src/version.cpp $ ctest -R version Always in library

The term bashTests is historical. These tests were originally bash scripts and have been rewritten in python. Visual Studio Users will appreciate the python implementation as it avoids the installation of mingw/cygwin and special PATH settings.

If you build the code in the directory <exiv2dir>/build, tests will run using the default values of Environment Variables.

TOC

Exiv2 Environment Variables

Exiv2 optionally uses several different environment variables when building or testing.

Variable Default Platforms Purpose
EXIV2_BINDIR <exiv2dir>/build/bin All Platforms Path of built binaries (e.g., exiv2.exe)
EXIV2_PORT 12762
12671
12760
Cygwin
MinGW/msys2
Other Platforms
Test TCP/IP Port
EXIV2_HTTP http://localhost All Platforms Test http server
EXIV2_ECHO not set All Platforms For debugging bashTests
VALGRIND not set All Platforms For debugging bashTests
VERBOSE not set Makefile platforms Instructs make to report its actions
PATH
DYLD_LIBRARY_PATH
LD_LIBRARY_PATH
$EXIV2_BINDIR/../lib Windows
macOS
Other platforms
Path of dynamic libraries

The Variable EXIV2_PORT or EXIV2_HTTP can be set to None to skip http tests. The http server is started with the command python3 -m http.server $port. On Windows, you will need to run this manually once to authorise the firewall to permit python to use the port.

TOC

Running tests on Unix-like systems

You can run tests directly from the build:

$ cmake -S . -B build -G "Unix Makefiles" -DEXIV2_BUILD_UNIT_TESTS=ON 
... lots of output and build summary ...
$ cmake --build build
... lots of output ...
$ ctest --test-dir build
... test summary ...
$

You can run individual tests in the test directory. Caution: If you build in a directory other than <exiv2dir>/build, you must set EXIV2_BINDIR to run tests from the test directory.

$ cd <exiv2dir>
$ ctest --test-dir build -R bash --verbose
addmoddel_test (testcases.TestCases) ... ok
....
Ran 176 tests in 9.526s
OK (skipped=6)

$ ctest --test-dir build -R bugfix --verbose
... lots of output ...
test_run (tiff_test.test_tiff_test_program.TestTiffTestProg) ... ok
----------------------------------------------------------------------
Ran 176 tests in 9.526s
OK (skipped=6)
$

TOC

Running tests on Visual Studio builds from cmd.exe

Caution: The python3 interpreter must be on the PATH, build for DOS, and called python3.exe. I copied the python.exe program:

> copy c:\Python37\python.exe c:\Python37\python3.exe
> set PATH=c:\Python37;%PATH%

You can execute the test suite in a similar manner to that described for UNIX-like systems. You must provide the -C config option to ctest for Visual Studio builds.

> cd <exiv2dir>
> ctest --test-dir build -C Release
> ctest --test-dir build -C Release -R bugfix --verbose

Visual Studio can build different configs as follows:

> cmake --build build --config Release        # or Debug or MinSizeRel or RelWithDebInfo
> ctest --test-dir build -C Release

The default for CMake config option --config is Release. ctest does not have a default for config option -C.

Running tests from cmd.exe

You can build with Visual Studio using Conan. The is described in detail in README-CONAN.md

As a summary, the procedure is:

c:\...\exiv2\build>conan install . --build missing --profile msvc2019Release
c:\...\exiv2\build>cmake -S . B build -DEXIV2_BUILD_UNIT_TESTS=ON -G "Visual Studio 16 2019"
c:\...\exiv2\build>cmake --build build --config Release
... lots of output from compiler and linker ...
c:\...\exiv2\build>ctest --test-dir build -C Release

If you wish to use an environment variables, use set:

set EXIV2_PORT=54321
ctest --test-dir build -C Release --verbose -R bash
set EXIV2_PORT=

TOC

Unit Tests

The code for the unit tests is in <exiv2dir>/unitTests. To include unit tests in the build, use the CMake option -DEXIV2_BUILD_UNIT_TESTS=ON.

There is a discussion on the web about installing GTest: #575

$ pushd /tmp
$ curl -LO https://github.com/google/googletest/archive/release-1.8.0.tar.gz
$ tar xzf   release-1.8.0.tar.gz
$ mkdir -p  googletest-release-1.8.0/build
$ pushd     googletest-release-1.8.0/build
$ cmake .. ; make ; make install
$ popd
$ popd

TOC

Bugfix Tests

You can run the bugfix tests from the build directory:

$ cd <exiv2dir>
$ ctest --test-dir build -R bugfix  

If you wish to run in verbose mode:

$ cd <exiv2dir>
$ ctest --test-dir build -R bugfix --verbose

The bugfix tests are stored in directory tests/ and you can run them all with the command:

$ cd <exiv2dir>/tests
$ export LD_LIBRARY_PATH="$PWD/../build/lib:$LD_LIBRARY_PATH"
$ python3 runner.py

You can run them individually with the commands such as:

$ cd <exiv2dir>/tests
$ python3 runner.py --verbose bugfixes/redmine/test_issue_841.py  # or $(find . -name "*841*.py")

You may wish to get a brief summary of failures with commands such as:

$ cd <exiv2dir>
$ ctest --test-dir build -R bugfix --verbose 2>&1 | grep FAIL

TOC

Fuzzing

The code for the fuzzers is in exiv2dir/fuzz

To build the fuzzers, use the cmake option -DEXIV2_BUILD_FUZZ_TESTS=ON and -DEXIV2_TEAM_USE_SANITIZERS=ON. Note that it only works with clang compiler as libFuzzer is integrated with clang > 6.0

To build the fuzzers:

$ cd <exiv2dir>
$ rm -rf build-fuzz
$ cmake -S . -B build-fuzz -DCMAKE_CXX_COMPILER=$(which clang++) -DEXIV2_BUILD_FUZZ_TESTS=ON -DEXIV2_TEAM_USE_SANITIZERS=ON
$ cmake --build build-fuzz

To execute a fuzzer:

cd <exiv2dir>/build-fuzz
mkdir corpus
./bin/fuzz-read-print-write corpus ../test/data/ -jobs=$(nproc) -workers=$(nproc) -max_len=4096

For more information about fuzzing see fuzz/README.md.

TOC

OSS-Fuzz

Exiv2 is enrolled in OSS-Fuzz, which is a fuzzing service for open-source projects, run by Google.

The build script used by OSS-Fuzz to build Exiv2 can be found here. It uses the same fuzz target (fuzz-read-print-write) as mentioned above, but with a slightly different build configuration to integrate with OSS-Fuzz. In particular, it uses the CMake option -DEXIV2_TEAM_OSS_FUZZ=ON, which builds the fuzz target without adding the -fsanitize=fuzzer flag, so that OSS-Fuzz can control the sanitizer flags itself.

TOC

Platform Notes

There are many ways to set up and configure your platform. The following notes are provided as a guide.

Linux

Update your system and install the build tools and dependencies (zlib, expat, gtest and others)

$ sudo apt --yes update
$ sudo apt install --yes build-essential ccache clang cmake git google-mock libbrotli-dev libcurl4-openssl-dev libexpat1-dev libgtest-dev libinih-dev libssh-dev libxml2-utils libz-dev python3 zlib1g-dev

For users of other platforms, the script /ci/install_dependencies.sh has code used to configure many platforms. The code in that file is a useful guide to configuring your platform.

Get the code from GitHub and build

$ mkdir -p ~/gnu/github/exiv2
$ cd ~/gnu/github/exiv2
$ git clone https://github.com/exiv2/exiv2
$ cd exiv2
$ cmake -S . -B build -G "Unix Makefiles"
$ cmake --build build

TOC

macOS

You will need to install Xcode and the Xcode command-line tools to build on macOS.

You should build and install libexpat and zlib. You may use brew, macports, build from source, or use conan.

I recommend that you build and install CMake from source.

TOC

MinGW/msys2

Please note that the 32bit MinGW platform is obsolete and superceded by the 64bit MSYS2 distribution. It is important to highlight that we rely on using the Universal C Runtime (UCRT) and its relatively new support for UTF-8. Check this PR for more information. Therefore you will need to use the MSYS2 URCT64 environment.

Install the latest version of MSYS2, and follow the installation instructions available here.

The CI workflow file .github/workflows/on_PR_windows_matrix.yml has a build job named msys2 with instructions showing how to configure Exiv2 on MSYS2.

Install exiv2 Dependencies

Please note that you will need to install the ucrt-x86_64 package version of the exiv2 dependencies:

pacman -S --needed mingw-w64-ucrt-x86_64-{brotli,cc,cmake,curl,expat,gettext,gtest,libiconv,libwinpthread,ninja,zlib}

Download exiv2 from github and build

Use the Windows start menu to open the terminal customized for the UCRT64 environment: MSYS2 MinGW UCRT x64. Then run the following commands to download exiv2, configure the project and build it:

mkdir -p ~/gnu/github/exiv2
cd       ~/gnu/github/exiv2
git clone https://github.com/exiv2/exiv2
cd exiv2
cmake -S . -B build
      -G Ninja
      -DCMAKE_CXX_FLAGS=-Wno-deprecated
      -DCMAKE_BUILD_TYPE=Release
      -DBUILD_SHARED_LIBS=ON
      -DEXIV2_BUILD_SAMPLES=ON
      -DEXIV2_ENABLE_NLS=OFF
      -DEXIV2_ENABLE_WEBREADY=ON
      -DEXIV2_ENABLE_BMFF=ON
      -DEXIV2_BUILD_UNIT_TESTS=ON
      ..

cmake --build build

The binaries generated at this point can be executed from the MSYS2 UCRT64 terminal, but they will not run from a Windows Command Prompt or PowerShell. The reason is that the MSYS2 UCRT64 terminal is properly configured to find some needed DLLs. In case you want to be able to run the generated exiv2 binary from any Windows terminal, you'll need to deploy the needed DLLs with the application.

TOC

Cygwin/64

Please note that the platform Cygwin/32 is obsolete and superceded by Cygwin/64.

Download: https://cygwin.com/install.html and run setup-x86_64.exe. I install into c:\cygwin64

You need: make, cmake, curl, gcc, gettext-devel pkg-config, dos2unix, tar, zlib-devel, libexpat1-devel, git, libxml2-devel python3-interpreter, libiconv, libxml2-utils, libncurses, libxml2-devel libxslt-devel python38 python38-pip python38-libxml2

The CI workflow file .github/workflows/on_PR_windows_matrix.yml has a build job named cygwin with instructions showing how to configure Exiv2 on Cygwin/64.

To build unit tests, you should install googletest-release-1.8.0 as discussed at Unit tests

I use the following batch file "cygwin64.bat" to start the Cygwin/64 bash shell from the Dos Command Prompt (cmd.exe).

@echo off
setlocal
set "PATH=c:\cygwin64\usr\local\bin;c:\cygwin64\bin;c:\cygwin64\usr\bin;c:\cygwin64\usr\sbin;"
if NOT EXIST %HOME% mkdir %HOME%
set "HOME=c:\cygwin64\home\rmills"
cd  %HOME%
set "PS1=\! CYGWIN64:\u@\h:\w \$ "
bash.exe -norc
endlocal

TOC

Visual Studio

We recommend that you use Conan to get the Exiv2 dependencies when using Visual Studio. Exiv2 v0.27 can be built with Visual Studio versions 2008 and later. For the main branch we actively support and build with Visual Studio 2019 and 2022.

As well as Visual Studio, you will need to install CMake, Python3, and Conan.

  1. Binary installers for CMake on Windows are availably from https://cmake.org/download/.
  2. Binary installers for Python3 are available from python.org
  3. Conan can be installed using python/pip. Details in README-CONAN.md
..>copy c:\Python37\python.exe c:\Python37\python3.exe

The python3 interpreter must be on your PATH.

It is important to highlight that we rely on using of the Universal C Runtime (UCRT) and its relatively new support for UTF-8. Check this PR for more information.

TOC

Unix

Exiv2 can be built on many Unix and Linux distros. With v0.27.2, we are starting to actively support the Unix Distributions NetBSD and FreeBSD. For v0.27.3, I have added support for Solaris 11.4

We do not have CI support for these platforms on GitHub. However, I regularly build and test them on my MacMini Buildserver. The device is private and not on the internet.

I have provided notes here based on my experience with these platforms. Feedback is welcome. I am willing to support Exiv2 on other commercial Unix distributions such as AIX, HP-UX and OSF/1 if you provide with an ssh account for your platform. I will require super-user privileges to install software.

For all platforms you will need the following components to build:

  1. gcc or clang
  2. cmake
  3. bash
  4. sudo
  5. gettext

To run the test suite, you need:

  1. python3
  2. chksum
  3. dos2unix
  4. xmllint

NetBSD

You can build exiv2 from source using the methods described for linux. I built and installed exiv2 using "Pure CMake" and didn't require conan.

You will want to use the package manager pkgsrc to build/install the build and test components listed above.

I entered links into the file system

# ln -s /usr/pkg/bin/python37 /usr/local/bin/python3
# ln -s /usr/pkg/bin/bash /bin/bash`

It's important to ensure that LD_LIBRARY_PATH includes /usr/local/lib and /usr/pkg/lib.

It's important to ensure that PATH includes /usr/local/bin, /usr/pkg/bin and /usr/pkg/sbin.

FreeBSD

Clang is pre-installed as ``/usr/bin/{cc|c++}` as well as libz and expat. FreeBSD uses pkg as the package manager which I used to install CMake and git.

$ su root
Password:
# pkg install cmake
# pkg install git
# pkg install bash
# pkg install python

Caution: The package manager pkg is no longer working on FreeBSD 12.0. I will move to 12.1 for future work. Others have reported this issue on 12.1. Broken package manager is very bad news. There are other package managers (such as ports), however installing and getting it to work is formidable.

634 rmills@rmillsmm-freebsd:~/gnu/github/exiv2/0.27-maintenance/build $ sudo pkg install libxml2
Updating FreeBSD repository catalogue...
pkg: repository meta /var/db/pkg/FreeBSD.meta has wrong version 2
pkg: Repository FreeBSD load error: meta cannot be loaded No error: 0
Fetching meta.txz: 100%    916 B   0.9kB/s    00:01
pkg: repository meta /var/db/pkg/FreeBSD.meta has wrong version 2
repository FreeBSD has no meta file, using default settings
Fetching packagesite.txz: 100%    6 MiB 340.2kB/s    00:19
pkg: repository meta /var/db/pkg/FreeBSD.meta has wrong version 2
pkg: Repository FreeBSD load error: meta cannot be loaded No error: 0
Unable to open created repository FreeBSD
Unable to update repository FreeBSD
Error updating repositories!
635 rmills@rmillsmm-freebsd:~/gnu/github/exiv2/0.27-maintenance/build $

Solaris

Solaris uses the package manager pkg. To get a list of packages:

$ pkg list

To install a package:

$ sudo pkg install developer/gcc-7

TOC

Written by Robin Mills
[email protected]
Updated: 2022-02-22

exiv2's People

Contributors

1div0 avatar a17r avatar ahuggel avatar alexvanderberkel avatar badola avatar cgilles avatar clanmills avatar d4n avatar danielkaneider avatar dependabot[bot] avatar draekko avatar hassec avatar jim-easterbrook avatar kevinbackhouse avatar kicer86 avatar kmilos avatar leohsiao1 avatar maheshmhegade avatar mohamedchebbii avatar mohamedchebbiiress avatar neheb avatar nkbj avatar norbertwg avatar piponazo avatar postscript-dev avatar ryanf55 avatar tbeu avatar vjschneid avatar vog avatar webmeister avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

exiv2's Issues

twin include

/src/webpimage.cpp) (line 47):
included twice
#include "tags_int.hpp"

using operator<< on ret val of Exiv2::lensName() on NEFs - returns integer value/not lens name

simple section of code is succesful finding lens name when examining Canon raw but Nikon NEFs cause an integer value to be returned.

Examining the same NEF with exiv2 util prints the correct lens name.

Code block:

                    Exiv2::Image::AutoPtr  orig = Exiv2::ImageFactory::open(filename);
                    orig->readMetadata();
                    cout << filename << ": x=" << orig->pixelWidth() << " y=" << orig->pixelHeight() << endl;
                    const Exiv2::ExifData  exif = orig->exifData();
                    Exiv2::ExifData::const_iterator  ln = Exiv2::lensName(exif);
                    if (ln != exif.end()) {
                        cout << *ln << endl;
                    }

Sample CR2
http://www.rawsamples.ch/raws/canon/RAW_CANON_EOS_5DMARK3.CR2
lensName returns Canon EF 24mm f/2.8 IS USM

Sample NEF
http://www.rawsamples.ch/raws/nikon/RAW_NIKON_D800_14bit_FX_LOSSLESS.NEF
lensName returns 147
exiv2 -pa .... | grep -i lens gives

Exif.Nikon3.LensType                         Byte        1  D G 
Exif.Nikon3.Lens                             Rational    4  24-70mm F2.8
Exif.Nikon3.LensFStops                       Undefined   4  6
Exif.NikonLd3.LensIDNumber                   Byte        1  Nikon AF-S Zoom-Nikkor 24-70mm f/2.8G ED
Exif.NikonLd3.LensFStops                     Byte        1  F6.0

Expecting lensName() to return "Nikon AF-S Zoom-Nikkor 24-70mm f/2.8G ED"

#0  0x000000000044c2aa in Exiv2::Internal::Nikon3MakerNote::printLensId (os=..., value=..., 
    metadata=0x0, group="NikonLd2") at nikonmn.cpp:2491
#1  0x000000000044c123 in Exiv2::Internal::Nikon3MakerNote::printLensId2 (os=..., value=..., 
    metadata=0x0) at nikonmn.cpp:1757
#2  0x0000000000417bb8 in Exiv2::Exifdatum::write (this=0x8bb2e0, os=..., pMetadata=0x0)
    at exif.cpp:230
#3  0x0000000000409fe1 in Exiv2::operator<< (os=..., md=...)
    at /tmp/exiv2-trunk/include/exiv2/metadatum.hpp:305
#4  0x0000000000409ad7 in main (argc=2, argv=0x7fffffffdf48) at leak.cc:327

For the Nikon case, this is because on metadata passed down is always NULL due to default = NULL param on std::ostream& Exifdatum::write(std::ostream& os, const ExifData* pMetadata =0) const;. This means in Nikon3MakerNote::printLensId(..) kicks out if (metadata == 0) return os << value; and never attempts to look up lens name.

Issue is present on 0.25 (from fedora 26) and also 0.26 from exiv2.org

twin include

here is another:

/src/pngimage.cpp) (line 40): (image_int.hpp)

so far all I found

feature req: flag to determine image contains embedded preview images

Exiv2::Image::AutoPtr  orig = Exiv2::ImageFactory::open(img.filename);
orig->readMetadata();
Exiv2::PreviewManager  prevldr(*orig);
Exiv2::PreviewPropertiesList  prevs = prevldr.getPreviewProperties();
if (prevs.empty()) { // no previews

Currently using this logic to determine if an image file (is a RAW file) has embedded preview image; is it efficient to add flag to Eviv2::Image to allow determination (ie is presence of preview images known at point of readMetadata())?

Only other way to currently do this is to check Exiv2::ImageType value against a list of known RAW files (nef/cr2...) that are known to potentially have embedded previews

API (possibly) not supplying full preview data

Hey,

@myfreeweb and I are currently trying to debug an issue in his fork of exiv2node.

I have been finding that previews extracted via his fork and the original package are producing preview which are missing a little bit of data from the end.

We are wondering do you do some post-processing when the CLI tool extracts the image that we need to replicate in the package or is there a bug in the API?

This is the issue where we have been discussing this: valpackett/exiv2node#2

Here is a copy of the diff I generated:
screen shot 2017-07-03 at 18 26 00

CVE-2017-11338: infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1470913

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1298062
(it's a rar archive containing the file used to reproduce the issue)

Here's a copy of the report:

$./exiv2 POC4
RW2 IMAGE

GDB debugging information is as follows:
(gdb) set args POC4
(gdb) r
 ...
(gdb) bt
#0  Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., option=Exiv2::kpsRecursive, start=0, 
    bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:492
#1  0x00007ffff70b90e1 in Exiv2::Image::printTiffStructure (this=0x611000009dc0, io=..., out=..., 
    option=Exiv2::kpsRecursive, depth=-1, offset=<optimized out>) at image.cpp:518
#2  0x00007ffff724924c in Exiv2::Rw2Image::printStructure (this=<optimized out>, out=..., option=<optimized out>, 
    depth=<optimized out>) at rw2image.cpp:115
#3  0x00007ffff724a1dc in Exiv2::Rw2Image::readMetadata (this=<optimized out>) at rw2image.cpp:134
#4  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#5  0x0000000000518489 in Action::Print::run (this=0x60400000da50, path=...) at actions.cpp:244
#6  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170

This vulnerability was triggered in Exiv2::Image::printIFDStructure () at image.cpp:492,which will result in a infinite loop.

 348         do {
 349             // Read top of directory
 350             io.seek(start,BasicIo::beg);
 351             io.read(dir.pData_, 2);
 352             uint16_t   dirLength = byteSwap2(dir,0,bSwap);
 353 
 354             bool tooBig = dirLength > 500;
 355             if ( tooBig ) throw Error(55);
 356 
 357             if ( bFirst && bPrint ) {
 359                 if ( tooBig ) out << Internal::indent(depth) << "dirLength = " << dirLength << std::endl;
 360             }
 361 
 ...
 491             if ( start ) {
 492                 io.read(dir.pData_, 4);
 493                 start = tooBig ? 0 : byteSwap4(dir,0,bSwap);
 494             }
 495         } while (start) ;

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

CVE-2017-11591: Floating point exception in the Exiv2::ValueType function

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1473888

The file used to reproduce this issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1302633
(this is a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC8

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Error: Directory Image, entry 0x0000 has invalid size 4286578688*8; skipping entry.
Warning: Directory Image, entry 0x0111: Strip 0 is outside of the data area; ignored.

Program received signal SIGFPE, Arithmetic exception.
0x000000000085bd64 in Exiv2::ValueType<std::pair<int, int> >::toLong(long) const ()
(gdb) bt
#0  0x000000000085bd64 in Exiv2::ValueType<std::pair<int, int> >::toLong(long) const ()
#1  0x000000000069e74b in Exiv2::Internal::TiffImageEntry::setStrips(Exiv2::Value const*, unsigned char const*, unsigned int, unsigned int) ()
#2  0x00000000006d87f2 in Exiv2::Internal::TiffReader::readDataEntryBase(Exiv2::Internal::TiffDataEntryBase*) ()
#3  0x00000000006a7226 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) ()
#4  0x00000000006a6f45 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) ()
#5  0x00000000006c0618 in Exiv2::Internal::TiffParserWorker::parse(unsigned char const*, unsigned int, unsigned int, Exiv2::Internal::TiffHeaderBase*) ()
#6  0x00000000006bbd00 in Exiv2::Internal::TiffParserWorker::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int, unsigned int, void (Exiv2::Internal::TiffDecoder::*(*)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned int, Exiv2::Internal::IfdId))(Exiv2::Internal::TiffEntryBase const*), Exiv2::Internal::TiffHeaderBase*) ()
#7  0x00000000006b901f in Exiv2::TiffImage::readMetadata() ()
#8  0x0000000000464434 in Action::Print::printSummary() ()
#9  0x0000000000463e5c in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
#10 0x0000000000439762 in main ()

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Add c++11 flag with CMake

We are not specifying the C++11 flags when configuring the project with CMake but we have options for adding those flags with the autotools.

The code is indeed using some c++11 features as the regex header.

video support

I run ./configure, but the output is not video supported, how can i fix this ?

------------------------------------------------------------------
-- Exiv2 0.26 feature configuration summary
--
-- Build a shared library......... YES
-- Use symbol visibility support.. YES
-- PNG image support.............. YES
-- Native language support........ NO

gettext is required for native language support. Make sure the
gettext header files and utilities are installed.
You can get gettext from http://www.gnu.org/software/gettext/

-- Nikon lens database............ YES
-- XMP metadata support........... YES
-- Video support.................. NO
-- Webready support............... NO
------------------------------------------------------------------

exiv2-0.26: build failure

I (and our CI, see the run: https://galileo.mailstation.de/jenkins/job/media/2191/console) get a build failure:

[ 62%] Linking CXX executable ../bin/exiv2
cd /var/tmp/paludis/build/graphics-exiv2-0.26/work/build/src && /usr/x86_64-pc-linux-gnu/bin/cmake -E cmake_link_script CMakeFiles/exiv2.dir/link.txt --verbose=1
/usr/bin/x86_64-pc-linux-gnu-c++  -march=native -O2 -pipe  -rdynamic CMakeFiles/exiv2.dir/exiv2.cpp.o CMakeFiles/exiv2.dir/actions.cpp.o CMakeFiles/exiv2.dir/utils.cpp.o  -o ../bin/exiv2 -Wl,-rpath,/var/tmp/paludis/build/graphics-exiv2-0.26/work/build/src: libexiv2.so.26.0.0 

Error:
  * In program cave perform install --hooks --managed-output --output-exclusivity with-others =graphics/exiv2-0.26:0::media --destination installed --replacing =graphics/exiv2-0.26:0::installed --x-of-y 1 of 1:
  * When installing 'graphics/exiv2-0.26:0::media' replacing { 'graphics/exiv2-0.26:0::installed' }:
  * When running an ebuild command on 'graphics/exiv2-0.26:0::media':
  * Install failed for 'graphics/exiv2-0.26:0::media' (paludis::ActionFailedError)

make[2]: Leaving directory '/var/tmp/paludis/build/graphics-exiv2-0.26/work/build'
make[1]: Leaving directory '/var/tmp/paludis/build/graphics-exiv2-0.26/work/build'
libexiv2.so.26.0.0: undefined reference to `pthread_rwlock_unlock'
libexiv2.so.26.0.0: undefined reference to `pthread_rwlock_init'
libexiv2.so.26.0.0: undefined reference to `pthread_rwlock_rdlock'
libexiv2.so.26.0.0: undefined reference to `pthread_rwlock_destroy'
libexiv2.so.26.0.0: undefined reference to `pthread_rwlock_wrlock'
collect2: error: ld returned 1 exit status
make[2]: *** [src/CMakeFiles/exiv2.dir/build.make:151: bin/exiv2] Error 1
make[1]: *** [CMakeFiles/Makefile2:241: src/CMakeFiles/exiv2.dir/all] Error 2
make: *** [Makefile:133: all] Error 2

We run into that when trying to compile exiv2 with both curl/ssh options disabled:

Fails:
-DEXIV2_ENABLE_CURL:BOOL=FALSE
-DEXIV2_ENABLE_SSH:BOOL=FALSE

Works:
-DEXIV2_ENABLE_CURL:BOOL=FALSE
-DEXIV2_ENABLE_SSH:BOOL=TRUE

Works:
-DEXIV2_ENABLE_CURL:BOOL=TRUE
-DEXIV2_ENABLE_SSH:BOOL=FALSE

Works:
-DEXIV2_ENABLE_CURL:BOOL=TRUE
-DEXIV2_ENABLE_SSH:BOOL=TRUE

CVE-2017-11339: heap-based buffer overflow in the Image::printIFDStructure function of image.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1470946

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1298133
(it's a rar archive containing the reproducer file)

Here's a copy of the report:

$./exiv2 POC5
*** Error in `/home/icy/real/exiv2/bin/.libs/lt-exiv2': free(): invalid next size (fast): 0x00000000015597b0 ***
Aborted


GDB debugging information is as follows:
(gdb) set args POC5
(gdb) r
 ...
Breakpoint 5, Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., option=Exiv2::kpsRecursive, 
    start=0, bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:404
404	                std::memcpy(buf.pData_,dir.pData_+8,4);  // copy dir[8:11] into buffer (short strings)

(gdb) bt
#0  Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., option=Exiv2::kpsRecursive, start=0, 
    bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:404
#1  0x00007ffff70b90e1 in Exiv2::Image::printTiffStructure (this=0x61300000de80, io=..., out=..., 
    option=Exiv2::kpsRecursive, depth=-1, offset=<optimized out>) at image.cpp:518
#2  0x00007ffff71972ac in Exiv2::OrfImage::printStructure (this=<optimized out>, out=..., option=<optimized out>, 
    depth=<optimized out>) at orfimage.cpp:104
#3  0x00007ffff7198631 in Exiv2::OrfImage::readMetadata (this=<optimized out>) at orfimage.cpp:123
#4  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#5  0x0000000000518489 in Action::Print::run (this=0x60400000d950, path=...) at actions.cpp:244
#6  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170
(gdb) s
=================================================================
==46719==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ed93 at pc 0x7ffff70b7adb bp 0x7fffffffbe10 sp 0x7fffffffbe08
WRITE of size 4 at 0x60200000ed93 thread T0
    #0 0x7ffff70b7ada  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43bada)
    #1 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #2 0x7ffff71972ab  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51b2ab)
    #3 0x7ffff7198630  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51c630)
    #4 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #5 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #6 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #7 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #8 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000ed93 is located 2 bytes to the right of 1-byte region [0x60200000ed90,0x60200000ed91)
allocated by thread T0 here:
    #0 0x4e1842  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1842)
    #1 0x7ffff70b0c5f  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434c5f)
    #2 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)

Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9db0: fa fa[01]fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x0c047fff9dc0: fa fa 06 fa fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9dd0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9de0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9df0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==46719==ABORTING
[Inferior 1 (process 46719) exited with code 01]

This vulnerability was triggered in Exiv2::Image::printIFDStructure () at image.cpp:404.

338	    void Image::printIFDStructure(BasicIo& io, std::ostream& out, Exiv2::PrintStructureOption option,uint32_t start,bool bSwap,char c,int depth)
	    {
...	
399	                                : 1
400	                                ;
401	
402	                // if ( offset > io.size() ) offset = 0; // Denial of service?
403	                DataBuf  buf(size*count + pad+20);  // allocate a buffer
404	                std::memcpy(buf.pData_,dir.pData_+8,4);  // copy dir[8:11] into buffer (short strings)
405	                if ( count*size > 4 ) {            // read into buffer
406	                    size_t   restore = io.tell();  // save
407	                    io.seek(offset,BasicIo::beg);  // position
408	                    io.read(buf.pData_,count*size);// read
...

	     }

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Please consider adding the feature of exporting cmake targets

Please consider adding the feature of exporting cmake targets as described in here. These feature will generate a exiv2-config.cmake or exiv2Config.cmake that allows the developers to use find_package(exiv2) in their downstream project in config mode as described in here so they don't have to write their own FindEXIV2.cmake.

Sigma 24-105mm F4 DG HSM ART not properly recognised

I recently purchased the above lens and exiv2(git master as of today) is not identifying it correctly.
I needed to add
{ 143, "Sigma 24-105mm F4 DG OS HSM [Art 013]" }, // 2
to the current canonmn.cpp file to have it detected correctly.

Note that there is another lens type at 255 which appears to be the same lens but mine provides a different identifier for some reason...

Adding the following to ~/.exiv2 worked as well:
[canon]
143=Sigma 24-105mm F4 DG HSM ART changed by me

I have attached a sample image which contains the relevant tags.

20170826_173544

Thanks,
Steve

bad free in Exiv2::Image::~Image (image.cpp:173)

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1495043

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1330345

Here's a copy of the report:

Liu Zhu 2017-09-24 23:04:22 EDT
Created attachment 1330345 [details]
poc_file

A bad free vulnerability was found in Exiv2::Image::~Image ,which allow attackers to cause a denial of service (bad free) via a crafted file.

./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

./exiv2 010_bad_free
==49036==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x60300000d570 in thread T0
#0 0x7fbdb6de5b2a in operator delete(void*) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99b2a)
#1 0x7fbdb665c127 in std::pair<int const, std::__cxx11::basic_string<char, std::char_traits, std::allocator > >::~pair() /usr/include/c++/5/bits/stl_pair.h:96
....
.....
...
#14 0x7fbdb665b1a1 in std::map<int, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::less, std::allocator<std::pair<int const, std::__cxx11::basic_string<char, std::char_traits, std::allocator > > > >::~map() /usr/include/c++/5/bits/stl_map.h:96
#15 0x7fbdb665310b in Exiv2::Image::~Image() /root/fuzzing/exiv2/src/image.cpp:173
#16 0x7fbdb66c30a5 in Exiv2::TiffImage::~TiffImage() /root/fuzzing/exiv2/include/exiv2/tiffimage.hpp:60
#17 0x7fbdb66c310d in Exiv2::TiffImage::~TiffImage() /root/fuzzing/exiv2/include/exiv2/tiffimage.hpp:60
#18 0x455263 in std::auto_ptrExiv2::Image::~auto_ptr() /usr/include/c++/5/backward/auto_ptr.h:170
#19 0x43ce5e in Action::Print::printSummary() /root/fuzzing/exiv2/src/actions.cpp:287
#20 0x43974b in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2/src/actions.cpp:244
#21 0x421fb9 in main /root/fuzzing/exiv2/src/exiv2.cpp:170
#22 0x7fbdb598b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#23 0x4219b8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x4219b8)

Other security vulnerability reports(2017-09-22) are here:
https://bugzilla.redhat.com/show_bug.cgi?id=1494443
https://bugzilla.redhat.com/show_bug.cgi?id=1494778
https://bugzilla.redhat.com/show_bug.cgi?id=1494781
https://bugzilla.redhat.com/show_bug.cgi?id=1494782
https://bugzilla.redhat.com/show_bug.cgi?id=1494787

CVE-2017-11592: alloc-dealloc-mismatch in Exiv2::FileIo::seek

I'm forwarding a security issue reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1473889

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1302634
(it's a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC9

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
__GI_fseek (fp=0x4647000000e900, offset=0, whence=1) at fseek.c:38
38	fseek.c: No such file or directory.
(gdb) bt
#0  __GI_fseek (fp=0x4647000000e900, offset=0, whence=1) at fseek.c:38
#1  0x00000000004c85e8 in Exiv2::FileIo::seek(long, Exiv2::BasicIo::Position) ()
#2  0x0000000000585750 in Exiv2::Image::printIFDStructure(Exiv2::BasicIo&, std::ostream&, Exiv2::PrintStructureOption, unsigned int, bool, char, int) ()
#3  0x000000000058b15c in Exiv2::Image::printTiffStructure(Exiv2::BasicIo&, std::ostream&, Exiv2::PrintStructureOption, int, unsigned long) ()
#4  0x00000000006bf786 in Exiv2::TiffImage::printStructure(std::ostream&, Exiv2::PrintStructureOption, int) ()
#5  0x00000000006b8eb9 in Exiv2::TiffImage::readMetadata() ()
#6  0x0000000000464434 in Action::Print::printSummary() ()
#7  0x0000000000463e5c in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
#8  0x0000000000439762 in main ()

The asan debug info is as follows:

=================================================================
==63376==ERROR: AddressSanitizer: alloc-dealloc-mismatch (INVALID vs operator delete) on 0x60300000d570
    #0 0x4e1c92  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1c92)
    #1 0x7f0c7c7d0bda  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cbda)
    #2 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #3 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #4 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #5 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #6 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #7 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #8 0x7f0c7c7d0b6a  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x44cb6a)
    #9 0x7f0c7b54ac91  (/lib/x86_64-linux-gnu/libc.so.6+0x39c91)
    #10 0x7f0c7b54ace4  (/lib/x86_64-linux-gnu/libc.so.6+0x39ce4)
    #11 0x7f0c7b531ac6  (/lib/x86_64-linux-gnu/libc.so.6+0x20ac6)
    #12 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60300000d570 is located 0 bytes inside of 4293853440-byte region [0x60300000d570,0x6030ffefd670)
ASAN:SIGSEGV
==63376==AddressSanitizer: while reporting a bug found another one. Ignoring.

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Build fails if EXIV2_ENABLE_BUILD_PO=TRUE

It looks like it tries to generate a file that does not make sense:

cd exiv2/exiv2-trunk/po && /usr/bin/msgmerge exiv2/exiv2-trunk/po/.po exiv2/exiv2-trunk/po/exiv2.pot
/usr/bin/msgmerge: error while opening "exiv2/exiv2-trunk/po/.po" for reading: No such file or directory
make[2]: *** [po/CMakeFiles/update_translations_exiv2.dir/build.make:93: po/.po] Error 1

Invalid memory address dereference in Exiv2::getULong(types.cpp:246)

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1494467

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1329503

Here's a copy of the report:

Liu Zhu 2017-09-22 06:19:01 EDT
Created attachment 1329503 [details]
PoC File

./exiv2 02-Invalid-mem-def
ASAN:SIGSEGV

==27020==ERROR: AddressSanitizer: SEGV on unknown address 0x62a100000405 (pc 0x7f827e6cc4af bp 0x7ffdbe4d55b0 sp 0x7ffdbe4d55a0 T0)
#0 0x7f827e6cc4ae in Exiv2::getULong(unsigned char const*, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/types.cpp:246
#1 0x7f827e6cc6cb in Exiv2::getURational(unsigned char const*, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/types.cpp:257
#2 0x7f827e57323c in std::pair<unsigned int, unsigned int> Exiv2::getValue<std::pair<unsigned int, unsigned int> >(unsigned char const*, Exiv2::ByteOrder) (/usr/local/exiv2_ASAN/lib/libexiv2.so.26+0x31523c)
#3 0x7f827e580b4e in Exiv2::ValueType<std::pair<unsigned int, unsigned int> >::read(unsigned char const*, long, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/include/exiv2/value.hpp:1586
#4 0x7f827e6c2d08 in Exiv2::Internal::TiffReader::readTiffEntry(Exiv2::Internal::TiffEntryBase*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1541
#5 0x7f827e6bf4be in Exiv2::Internal::TiffReader::visitEntry(Exiv2::Internal::TiffEntry*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1204
#6 0x7f827e68d97c in Exiv2::Internal::TiffEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:896
#7 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#8 0x7f827e68dcc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#9 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#10 0x7f827e68e351 in Exiv2::Internal::TiffIfdMakernote::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:949
#11 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#12 0x7f827e68e1bf in Exiv2::Internal::TiffMnEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:938
#13 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#14 0x7f827e68dcc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#15 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#16 0x7f827e68e07e in Exiv2::Internal::TiffSubIfd::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:931
#17 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#18 0x7f827e68dcc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#19 0x7f827e68d909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#20 0x7f827e6a6451 in Exiv2::Internal::TiffParserWorker::parse(unsigned char const*, unsigned int, unsigned int, Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:2011
#21 0x7f827e6a5267 in Exiv2::Internal::TiffParserWorker::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int, unsigned int, void (Exiv2::Internal::TiffDecoder::()(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, unsigned int, Exiv2::Internal::IfdId))(Exiv2::Internal::TiffEntryBase const*), Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:1900
#22 0x7f827e6a3a82 in Exiv2::TiffParser::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:266
#23 0x7f827e5a043e in Exiv2::ExifParser::decode(Exiv2::ExifData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/exif.cpp:629
#24 0x7f827e5e0030 in Exiv2::JpegBase::readMetadata() /root/fuzzing/exiv2-trunk/src/jpgimage.cpp:386
#25 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
#26 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
#27 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
#28 0x7f827d91c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#29 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/fuzzing/exiv2-trunk/src/types.cpp:246 Exiv2::getULong(unsigned char const*, Exiv2::ByteOrder)
==27020==ABORTING
[reply] [−] Comment 2 Liu Zhu 2017-09-23 01:14:58 EDT
./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

Compilation error on Windows when UNICODE support is enabled

Hi,

I am writing a conan recipe for your project and I found out that there is an compilation error on Windows when the UNICODE support is enabled. Note that I am using the v0.26 tag.

This is the error:
C:\Users\luis\.conan\data\Exiv2\0.26-0\pix4d\stable\build\64046ffd699a91c9898304651b021d7e7eebc274\exiv2\src\actions.cpp(2121): error C2664: 'std::string Exiv2::ws2s(const std::wstring &)' : cannot convert argument 1 from 'std::string ' to 'const std::wstring &' [C:\Users\luis\.conan\data\Exiv2\0.26-0\pix4d\stable\build\64046ffd699a91c9898304651b021d7e7eebc274\build\src\exiv2.vcxproj]

These are the CMake variables that I used:

        cmake_args = {'EXIV2_ENABLE_NLS' : 'OFF',
                      'EXIV2_ENABLE_LENSDATA' : 'OFF',
                      'EXIV2_ENABLE_COMMERCIAL' : 'OFF',
                      'EXIV2_ENABLE_VIDEO' : 'OFF',
                      'EXIV2_ENABLE_WEBREADY' : 'OFF',
                      'EXIV2_ENABLE_CURL' : 'OFF',
                      'EXIV2_ENABLE_SSH' : 'OFF',
                      'EXIV2_ENABLE_BUILD_SAMPLES' : 'OFF',
                      'EXIV2_ENABLE_BUILD_PO' : 'OFF',
                      'EXIV2_ENABLE_SHARED' : 'ON',
                      'EXIV2_ENABLE_XMP' : 'ON',
                      'EXIV2_ENABLE_PNG' : 'ON',
                      'CMAKE_INSTALL_PREFIX' : self.package_folder,
                      'CMAKE_BUILD_TYPE' : self.settings.build_type,
                     }
        if self.settings.os == 'Windows':
            cmake_args['EXIV2_ENABLE_WIN_UNICODE'] = 'ON'
            cmake_args['EXIV2_ENABLE_LIBXMP'] = 'ON'

            cmake_args['EXPAT_INCLUDE_DIR'] = expat_include_dir
            cmake_args['EXPAT_LIBRARY'] = expat_library
            cmake_args['ZLIB_INCLUDE_DIR'] = zlib_include_dir
            cmake_args['ZLIB_LIBRARY'] = zlib_library

When I disable the EXIV2_ENABLE_WIN_UNICODE the compilation finishes properly.

Are you aware of this problem?

CVE-2017-11336: Heap overflow in Exiv2::Image::printIFDStructure

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1470729

The file used to reproduce the issue is here: https://bugzilla.redhat.com/attachment.cgi?id=1297685
(it's a rar archive that needs to be unpacked)

Here's a copy of the report:
The output information is as follows:

$./exiv2 POC2

*** Error in `/home/icy/real/exiv2/bin/.libs/lt-exiv2': malloc(): memory corruption: 0x0000000001cc71d0 ***
Aborted

ASAN output information:

$./exiv2 POC2

==96688==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ed9c at pc 0x7fec442f1a42 bp 0x7ffdeed50350 sp 0x7ffdeed50348
READ of size 1 at 0x60200000ed9c thread T0
    #0 0x7fec442f1a41  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43ba41)
    #1 0x7fec442f30e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #2 0x7fec44503900  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x64d900)
    #3 0x7fec444fb5eb  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x6455eb)
    #4 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #5 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #6 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #7 0x7fec43063abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #8 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000ed9c is located 0 bytes to the right of 12-byte region [0x60200000ed90,0x60200000ed9c)
allocated by thread T0 here:
    #0 0x4e1842  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1842)
    #1 0x7fec442eac5f  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434c5f)
    #2 0x7fec442f30e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)

Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9db0: fa fa 00[04]fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x0c047fff9dc0: fa fa 06 fa fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9dd0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9de0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9df0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==96688==ABORTING

The GDB debugging information is as follows:
(gdb) set args POC32
(gdb) r
...

(gdb) bt
#0  Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., option=Exiv2::kpsRecursive, start=0, 
    bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:430
#1  0x00007ffff70b90e1 in Exiv2::Image::printTiffStructure (this=0x61300000de80, io=..., out=..., 
    option=Exiv2::kpsRecursive, depth=-1, offset=<optimized out>) at image.cpp:518
#2  0x00007ffff72c9901 in Exiv2::TiffImage::printStructure (this=<optimized out>, out=..., option=<optimized out>, 
    depth=<optimized out>) at tiffimage.cpp:348
#3  0x00007ffff72c15ec in Exiv2::TiffImage::readMetadata (this=<optimized out>) at tiffimage.cpp:191
#4  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#5  0x0000000000518489 in Action::Print::run (this=0x60400000da50, path=...) at actions.cpp:244
#6  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170
(gdb) s
Exiv2::Image::byteSwap4 (this=<optimized out>, buf=..., offset=<optimized out>, bSwap=<optimized out>) at image.cpp:269
269	        p[0] = buf.pData_[offset];
(gdb) s
=================================================================
==45031==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ed9c at pc 0x7ffff70b7a42 bp 0x7fffffffbd30 sp 0x7fffffffbd28
READ of size 1 at 0x60200000ed9c thread T0
    #0 0x7ffff70b7a41  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43ba41)
    #1 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #2 0x7ffff72c9900  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x64d900)
    #3 0x7ffff72c15eb  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x6455eb)
    #4 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #5 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #6 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #7 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #8 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000ed9c is located 0 bytes to the right of 12-byte region [0x60200000ed90,0x60200000ed9c)
allocated by thread T0 here:
    #0 0x4e1842  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1842)
    #1 0x7ffff70b0c5f  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434c5f)
    #2 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)

Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9db0: fa fa 00[04]fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x0c047fff9dc0: fa fa 06 fa fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9dd0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9de0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9df0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==45031==ABORTING
[Inferior 1 (process 45031) exited with code 01]

This vulnerability was triggered in Exiv2::Image::byteSwap4 () at image.cpp:269.

 265     uint32_t Image::byteSwap4(DataBuf& buf,size_t offset,bool bSwap)
 266     {   
 267         uint32_t v;
 268         char*    p = (char*) &v;
 269         p[0] = buf.pData_[offset];
 270         p[1] = buf.pData_[offset+1];
 271         p[2] = buf.pData_[offset+2];
 272         p[3] = buf.pData_[offset+3];
 273         return Image::byteSwap(v,bSwap);
 274     }

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Website inside code repository?

I realise this is for historical reasons, but still makes this repository a bit unwieldy. There are ways to split a directory off into its own repository while keeping all git history, KDE does it all the time.

CVE-2017-12957: heap-based buffer over-read in the Exiv2::Image::io function in image.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1482423

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1315757
(it's a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC12
ORF IMAGE
ORF IMAGE
*** Error in `./../../../exiv2': free(): invalid next size (fast): 0x0000000000cead30 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f837322d7e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7f837323637a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7f837323a53c]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image17printIFDStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEjbci+0x4124)[0x7f8373fab6b4]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image18printTiffStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEim+0x12a)[0x7f8373fae0fa]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv28OrfImage12readMetadataEv+0x162)[0x7f837403f2c2]
./../../../exiv2[0x4276f8]
./../../../exiv2[0x42727c]
./../../../exiv2[0x4073a0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f83731d6830]
./../../../exiv2[0x406c89]
======= Memory map: ========
00400000-00467000 r-xp 00000000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00666000-00667000 r--p 00066000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00667000-00668000 rw-p 00067000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00668000-00678000 rw-p 00000000 00:00 0 
00cd7000-00d09000 rw-p 00000000 00:00 0                                  [heap]
7f836c000000-7f836c021000 rw-p 00000000 00:00 0 
7f836c021000-7f8370000000 ---p 00000000 00:00 0 
7f8372a9b000-7f8372d73000 r--p 00000000 08:01 1048676                    /usr/lib/locale/locale-archive
7f8372d73000-7f8372d99000 r-xp 00000000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7f8372d99000-7f8372f99000 ---p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7f8372f99000-7f8372f9b000 r--p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7f8372f9b000-7f8372f9c000 rw-p 00028000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7f8372f9c000-7f8372fb5000 r-xp 00000000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7f8372fb5000-7f83731b4000 ---p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7f83731b4000-7f83731b5000 r--p 00018000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7f83731b5000-7f83731b6000 rw-p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7f83731b6000-7f8373376000 r-xp 00000000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7f8373376000-7f8373576000 ---p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7f8373576000-7f837357a000 r--p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7f837357a000-7f837357c000 rw-p 001c4000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7f837357c000-7f8373580000 rw-p 00000000 00:00 0 
7f8373580000-7f8373596000 r-xp 00000000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8373596000-7f8373795000 ---p 00016000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8373795000-7f8373796000 rw-p 00015000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8373796000-7f837389e000 r-xp 00000000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7f837389e000-7f8373a9d000 ---p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7f8373a9d000-7f8373a9e000 r--p 00107000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7f8373a9e000-7f8373a9f000 rw-p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7f8373a9f000-7f8373c11000 r-xp 00000000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f8373c11000-7f8373e11000 ---p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f8373e11000-7f8373e1b000 r--p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f8373e1b000-7f8373e1d000 rw-p 0017c000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f8373e1d000-7f8373e21000 rw-p 00000000 00:00 0 
7f8373e21000-7f83742c9000 r-xp 00000000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7f83742c9000-7f83744c9000 ---p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7f83744c9000-7f83744fa000 r--p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7f83744fa000-7f83744fc000 rw-p 004d9000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7f83744fc000-7f8374518000 rw-p 00000000 00:00 0 
7f8374518000-7f8374530000 r-xp 00000000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7f8374530000-7f837472f000 ---p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7f837472f000-7f8374730000 r--p 00017000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7f8374730000-7f8374731000 rw-p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7f8374731000-7f8374735000 rw-p 00000000 00:00 0 
7f8374735000-7f8374738000 r-xp 00000000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7f8374738000-7f8374937000 ---p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7f8374937000-7f8374938000 r--p 00002000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7f8374938000-7f8374939000 rw-p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7f8374939000-7f837495f000 r-xp 00000000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7f8374b36000-7f8374b3e000 rw-p 00000000 00:00 0 
7f8374b5b000-7f8374b5e000 rw-p 00000000 00:00 0 
7f8374b5e000-7f8374b5f000 r--p 00025000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7f8374b5f000-7f8374b60000 rw-p 00026000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7f8374b60000-7f8374b61000 rw-p 00000000 00:00 0 
7ffe634ba000-7ffe634db000 rw-p 00000000 00:00 0                          [stack]
7ffe63503000-7ffe63505000 r--p 00000000 00:00 0                          [vvar]
7ffe63505000-7ffe63507000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted


GDB debugging information is as follows:
(gdb) set args POC12
(gdb) r
 ...

Breakpoint 7, Exiv2::Image::io (this=<optimized out>) at image.cpp:700
700	        return *io_;
(gdb) bt 
#0  Exiv2::Image::io (this=<optimized out>) at image.cpp:700
#1  0x00007ffff719728d in Exiv2::OrfImage::printStructure (this=<optimized out>, out=..., option=Exiv2::kpsRecursive, 
    depth=0) at orfimage.cpp:104
#2  0x00007ffff7198631 in Exiv2::OrfImage::readMetadata (this=<optimized out>) at orfimage.cpp:123
#3  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#4  0x0000000000518489 in Action::Print::run (this=0x60400000d950, path=...) at actions.cpp:244
#5  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170
(gdb) n
=================================================================
==77134==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ed96 at pc 0x7ffff70b7a21 bp 0x7fffffffbdf0 sp 0x7fffffffbde8
READ of size 1 at 0x60200000ed96 thread T0
    #0 0x7ffff70b7a20  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43ba20)
    #1 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #2 0x7ffff71972ab  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51b2ab)
    #3 0x7ffff7198630  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51c630)
    #4 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #5 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #6 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #7 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #8 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000ed96 is located 0 bytes to the right of 6-byte region [0x60200000ed90,0x60200000ed96)
allocated by thread T0 here:
    #0 0x4e1842  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1842)
    #1 0x7ffff70b0c5f  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434c5f)
    #2 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)

Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9db0: fa fa[06]fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x0c047fff9dc0: fa fa 06 fa fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9dd0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9de0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff9df0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==77134==ABORTING
[Inferior 1 (process 77134) exited with code 01]
(gdb) 

This vulnerability was triggered in Exiv2::Image::io (this=) at image.cpp:700

700	        return *io_;

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Retain msvc/ solution and project files

I am very concerned about the criticism of my desire to retain the msvc/ solution and project files. It is my opinion that CMake/Visual Studio struggles to build Exiv2. And while there is a case to consider this matter, there is strong evidence that Visual Studio Users do not like CMake. I could discuss subjects such as the zlib/zlibstatic issue, concerns about static linking and other matters. However I want to focus on something that we never discuss "The Visual Studio User Experience".

Visual Studio users like Visual Studio. You open the solution and build. They effortless switch between 64 and 32 bit builds, debug/release, static/dll. It has a great debugger and object browser. The UI enables tweaks to build settings. It's a very nice place in which Windows Developers are productive and happy.

CMake destroys all of this. Instead of opening the solution, you have to run this strange tool which doesn't understand how to find or link dependencies. If you tweak any setting in the Visual Studio UI, CMake will silently undo your changes and enforce his strong will on your project. Trying to discuss this with CMake Lovers results in abusive comments and pointless criticism of Windows by folks who clearly do not know Visual Studio.

As the msvc/ solution files have been in production with Exiv2 for almost 10 years, I don't see any reason to remove them. They work. I am not asking for other team members to be involved in the support of those files.

In 2014, I invested 200 hours in contrib/cmake/msvc/cmakeBuild.cmd. I have tried hard to make CMake/Visual Studio work well. And indeed the nightly build of Exiv2 is performed by that script.

I will support the removal of msvc/ when I am convinced that CMake/Visual Studio with conan or vcpkg is a genuine replacement for msvc/. Until then, I ask other team members to support my contribution and stop discussing this matter. After all, I use msvc/ and I'm not asking anybody else to do any work to support msvc/

exiv2 0.26 build failure on older OS X systems

On older (Mac) OS X systems (pre 10.7) the build fails with:

:info:build [ 54%] Building CXX object src/CMakeFiles/exiv2.dir/actions.cpp.o :info:build cd /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/src && /usr/bin/g++-4.2 -DEXV_HAVE_DLL -DEXV_HAVE_STDINT_H -DEXV_LOCALEDIR=\"/opt/local/share/locale\" -I/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/src -I/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/include -I/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/include/exiv2 -I/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk -I/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/xmpsdk/include -I/opt/local/include -pipe -Os -DNDEBUG -arch ppc -mmacosx-version-min=10.5 -std=c++98 -o CMakeFiles/exiv2.dir/actions.cpp.o -c /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/src/actions.cpp :info:build /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_graphics_exiv2/exiv2/work/exiv2-trunk/src/actions.cpp:2050: error: ‘PTHREAD_RECURSIVE_MUTEX_INITIALIZER’ was not declared in this scope

Also see https://trac.macports.org/ticket/54335

CVE-2017-12956: illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1482296

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1314499
(it's a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC12
*** Error in `/home/icy/real/exiv2/install/bin/exiv2': malloc(): smallbin double linked list corrupted: 0x000000000068bc80 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff66cb7e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82651)[0x7ffff66d6651]
/lib/x86_64-linux-gnu/libc.so.6(__libc_malloc+0x54)[0x7ffff66d8184]
/usr/lib/x86_64-linux-gnu/libstdc++.so.6(_Znwm+0x18)[0x7ffff6fcae78]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZNK5Exiv26FileIo4pathB5cxx11Ev+0xc9)[0x7ffff7371a49]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image17printIFDStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEjbci+0x4632)[0x7ffff7449bc2]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image18printTiffStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEim+0x12a)[0x7ffff744c0fa]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv28OrfImage12readMetadataEv+0x162)[0x7ffff74dd2c2]
/home/icy/real/exiv2/install/bin/exiv2[0x4276f8]
/home/icy/real/exiv2/install/bin/exiv2[0x42727c]
/home/icy/real/exiv2/install/bin/exiv2[0x4073a0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff6674830]
/home/icy/real/exiv2/install/bin/exiv2[0x406c89]
======= Memory map: ========
00400000-00467000 r-xp 00000000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00666000-00667000 r--p 00066000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00667000-00668000 rw-p 00067000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00668000-006aa000 rw-p 00000000 00:00 0                                  [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0 
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0 
7ffff5f39000-7ffff6211000 r--p 00000000 08:01 1048676                    /usr/lib/locale/locale-archive
7ffff6211000-7ffff6237000 r-xp 00000000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7ffff6237000-7ffff6437000 ---p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7ffff6437000-7ffff6439000 r--p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7ffff6439000-7ffff643a000 rw-p 00028000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7ffff643a000-7ffff6453000 r-xp 00000000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7ffff6453000-7ffff6652000 ---p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7ffff6652000-7ffff6653000 r--p 00018000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7ffff6653000-7ffff6654000 rw-p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7ffff6654000-7ffff6814000 r-xp 00000000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff6814000-7ffff6a14000 ---p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff6a14000-7ffff6a18000 r--p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff6a18000-7ffff6a1a000 rw-p 001c4000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff6a1a000-7ffff6a1e000 rw-p 00000000 00:00 0 
7ffff6a1e000-7ffff6a34000 r-xp 00000000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff6a34000-7ffff6c33000 ---p 00016000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff6c33000-7ffff6c34000 rw-p 00015000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff6c34000-7ffff6d3c000 r-xp 00000000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7ffff6d3c000-7ffff6f3b000 ---p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7ffff6f3b000-7ffff6f3c000 r--p 00107000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7ffff6f3c000-7ffff6f3d000 rw-p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7ffff6f3d000-7ffff70af000 r-xp 00000000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7ffff70af000-7ffff72af000 ---p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7ffff72af000-7ffff72b9000 r--p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7ffff72b9000-7ffff72bb000 rw-p 0017c000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7ffff72bb000-7ffff72bf000 rw-p 00000000 00:00 0 
7ffff72bf000-7ffff7767000 r-xp 00000000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7ffff7767000-7ffff7967000 ---p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7ffff7967000-7ffff7998000 r--p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7ffff7998000-7ffff799a000 rw-p 004d9000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7ffff799a000-7ffff79b6000 rw-p 00000000 00:00 0 
7ffff79b6000-7ffff79ce000 r-xp 00000000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7ffff79ce000-7ffff7bcd000 ---p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7ffff7bcd000-7ffff7bce000 r--p 00017000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7ffff7bce000-7ffff7bcf000 rw-p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7ffff7bcf000-7ffff7bd3000 rw-p 00000000 00:00 0 
7ffff7bd3000-7ffff7bd6000 r-xp 00000000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7ffff7bd6000-7ffff7dd5000 ---p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7ffff7dd5000-7ffff7dd6000 r--p 00002000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7ffff7dd6000-7ffff7dd7000 rw-p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fd0000-7ffff7fd8000 rw-p 00000000 00:00 0 
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0 
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0                          [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff6689428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

The gdb debugging information is as follows:

(gdb) set args POC12
(gdb) r
...
Breakpoint 2, malloc_printerr (ar_ptr=0x7fffffffd250, ptr=0x68bc80, 
    str=0x7ffff67e52c8 "malloc(): smallbin double linked list corrupted", action=3) at malloc.c:5006
5006	malloc.c: No such file or directory.
(gdb) bt 
#0  malloc_printerr (ar_ptr=0x7fffffffd250, ptr=0x68bc80, 
    str=0x7ffff67e52c8 "malloc(): smallbin double linked list corrupted", action=3) at malloc.c:5006
#1  _int_malloc (av=av@entry=0x7ffff6a18b20 <main_arena>, bytes=bytes@entry=51) at malloc.c:3386
#2  0x00007ffff66d8184 in __GI___libc_malloc (bytes=51) at malloc.c:2913
#3  0x00007ffff6fcae78 in operator new(unsigned long) () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4  0x00007ffff7371a49 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char*> (this=0x7fffffffd468, __beg=0x68ccd0 "id:000052,sig:11,src:001652+001281,op:splice,rep:2", __end=<optimized out>)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/basic_string.tcc:223
#5  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct_aux<char*> (
    this=0x7fffffffd468, __beg=0x68ccd0 "id:000052,sig:11,src:001652+001281,op:splice,rep:2", __end=<optimized out>)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/basic_string.h:195
#6  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char*> (
    this=0x7fffffffd468, __beg=0x68ccd0 "id:000052,sig:11,src:001652+001281,op:splice,rep:2", __end=<optimized out>)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/basic_string.h:214
#7  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string (this=0x7fffffffd468, 
    __str=...) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/basic_string.h:400
#8  Exiv2::FileIo::path[abi:cxx11]() const (this=<optimized out>) at basicio.cpp:1031
#9  0x00007ffff7449bc2 in Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., 
    option=<optimized out>, start=<optimized out>, bSwap=<optimized out>, c=<optimized out>, depth=<optimized out>)
    at image.cpp:498
#10 0x00007ffff744c0fa in Exiv2::Image::printTiffStructure (this=0x68bab0, io=..., out=..., option=Exiv2::kpsRecursive, 
    depth=<optimized out>, offset=<optimized out>) at image.cpp:518
#11 0x00007ffff74dd2c2 in Exiv2::OrfImage::readMetadata (this=0x68bab0) at orfimage.cpp:123
#12 0x00000000004276f8 in Action::Print::printSummary (this=0x68cc30) at actions.cpp:289
---Type <return> to continue, or q <return> to quit---
Python Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
#13 0x000000000042727c in Action::Print::run (this=0x68cc30, path=) at actions.cpp:244
#14 0x00000000004073a0 in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170
(gdb) n
5007	in malloc.c
(gdb) 
5006	in malloc.c
(gdb) 
*** Error in `/home/icy/real/exiv2/install/bin/exiv2': malloc(): smallbin double linked list corrupted: 0x000000000068bc80 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff66cb7e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82651)[0x7ffff66d6651]
/lib/x86_64-linux-gnu/libc.so.6(__libc_malloc+0x54)[0x7ffff66d8184]
/usr/lib/x86_64-linux-gnu/libstdc++.so.6(_Znwm+0x18)[0x7ffff6fcae78]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZNK5Exiv26FileIo4pathB5cxx11Ev+0xc9)[0x7ffff7371a49]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image17printIFDStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEjbci+0x4632)[0x7ffff7449bc2]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image18printTiffStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEim+0x12a)[0x7ffff744c0fa]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv28OrfImage12readMetadataEv+0x162)[0x7ffff74dd2c2]
/home/icy/real/exiv2/install/bin/exiv2[0x4276f8]
/home/icy/real/exiv2/install/bin/exiv2[0x42727c]
/home/icy/real/exiv2/install/bin/exiv2[0x4073a0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff6674830]
/home/icy/real/exiv2/install/bin/exiv2[0x406c89]
======= Memory map: ========
00400000-00467000 r-xp 00000000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00666000-00667000 r--p 00066000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00667000-00668000 rw-p 00067000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00668000-006aa000 rw-p 00000000 00:00 0                                  [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0 
...
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff6689428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

This vulnerability was triggered in Exiv2::FileIo::pathabi:cxx11 const (this=0x68ccb0) at basicio.cpp:1031

...
1026	#ifdef EXV_UNICODE_PATH
1027	        if (p_->wpMode_ == Impl::wpUnicode) {
1028	            return ws2s(p_->wpath_);
1029	        }
1030	#endif
1031	        return p_->path_;
1032	    }
1033	
1034	#ifdef EXV_UNICODE_PATH
1035	    std::wstring FileIo::wpath() const

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

What does count() exactly do?

From the class reference:

long count () const
Get the number of metadata entries.

From the examples:

$ exifprint img_2158.jpg
Exif.Image.Model                  0x0110 Ascii       7  Test 1

What does that md->count() // 7 mean?


I also asked stacked the question here? Unfortunately, the it is no more. 😢

I have hunch... (after reading the source, obviously) 🤞

  • exif.cpp keeps referring to a value_*
  • value.cpp implements multiple count methods which return some version of size()
  • size() calculates the length of the string buffer from ostringstream, so most probably the image metadata.

exiv2 0.26 checksum mismatch

URL: http://www.exiv2.org/builds/exiv2-0.26-trunk.tar.gz

Expected SHA-256: 0c625cbeb494aa1b9221280a5b053b54d0c9720d48fa9120cef7c6f93efd4dc3

Actual SHA-256:
c75e3c4a0811bf700d92c82319373b7a825a2331c12b8b37d41eb58e4f18eafb

The expected checksum is what what we had in Homebrew for the SHA-256 when the formula was upgraded to 0.26 on Fri May 19 15:49:32 2017 -0400. See Homebrew/homebrew-core#13736.

But currently downloading the file yields a different checksum.

I wanted to make sure you weren't hacked, and ask what the reason(s) for the changes were.

Drop std::auto_ptr usage

std::auto_ptr is old, deprecated and I causes build problems on some platforms (VisualStudio with c++17 enabled has no std::auto_ptr).

I would suggest to replace it with std::unque_ptr (at least on some cmake switch).

Feature Req: modify/update/remove preview images in RAW files

[ feature request / query ]

RAW files contain preview images of various sizes; for Nikon NEFs there's a small tiff + 1 medium jpg and then 1 full sized jpg that are generated at the time of capture.

I would like the ability to remove/update the preview images in a RAW file - is this technically possible and functionality make available?

The use case:
RAW files will get processed by tools like Adobe Lightroom, (old and retired) CaptureNX2 etc. Edits are made to generate a final image: tiff or jpeg for final output.

However, when archiving the RAW files to DVD or NAS I want to store the final tiff/jpeg embedded in the RAW file - this has the benefits:

  • simplifies archival content management; one file archived (the RAW file which includes the final processed jpg/tif) and jpeg/tif can be extracted at any time
  • removes dependency on RAW processor meta/sidecar files (Lightroom) that may change in future
  • preview tools (GUI file explorers that extract thumbnails from RAW files) can reflect RAW image processed contents

Nikon's CaptureNX2 had functionality to remove all previews and leave a small thumbnail in their NEFs but this is slightly different to others since it was writing edit tags in the meta for CaptureNX2 to read/process (no sidecars)

CVE-2017-11683: reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1475124

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1310025
(this is a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC

invalid type value detected in Image::printIFDStructure:  0
Error: Directory Image: Next pointer is out of bounds; ignored.
Warning: Directory Image, entry 0x0002 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0002 is out of bounds: Offset = 0x00000002, size = 65540, exceeds buffer size by 64830 Bytes; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 497; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x02297fba; truncating the entry
Warning: Directory Image, entry 0x4900 has unknown Exif (TIFF) type 18697; setting type size 1.
Error: Directory Image, entry 0x4900 has invalid size 524428033*1; skipping entry.
Warning: Directory Image, entry 0x8000 has unknown Exif (TIFF) type 65535; setting type size 1.
Error: Offset of directory Image, entry 0x8000 is out of bounds: Offset = 0xff7f0222; truncating the entry
Warning: Directory Image, entry 0x02ef has unknown Exif (TIFF) type 0; setting type size 1.
Error: Directory Image, entry 0x02ef has invalid size 1325435904*1; skipping entry.
Error: Offset of directory Image, entry 0x0149 is out of bounds: Offset = 0x03020200; truncating the entry
Warning: Directory Image, entry 0x8800 has unknown Exif (TIFF) type 65279; setting type size 1.
Warning: Directory Image, entry 0xff02 has unknown Exif (TIFF) type 4866; setting type size 1.
Error: Offset of directory Image, entry 0xff02 is out of bounds: Offset = 0x00007f00; truncating the entry
Warning: Directory Image, entry 0x0100 has unknown Exif (TIFF) type 2377; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0100 is out of bounds: Offset = 0x00000100, size = 131401, exceeds buffer size by 130945 Bytes; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 514; setting type size 1.
Error: Directory Image, entry 0x0200 has invalid size 4278125056*1; skipping entry.
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x490a4901; truncating the entry
Warning: Directory Image, entry 0x0201 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0201 is out of bounds: Offset = 0x02020000; truncating the entry
Warning: Directory Image, entry 0x0002 has unknown Exif (TIFF) type 65416; setting type size 1.
Error: Directory Image, entry 0x0002 has invalid size 284819469*1; skipping entry.
Warning: Directory Image, entry 0x0207 has unknown Exif (TIFF) type 767; setting type size 1.
Error: Offset of directory Image, entry 0x0207 is out of bounds: Offset = 0x007f5d00; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 18689; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x00010000; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x02020000; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 511; setting type size 1.
Error: Offset of directory Image, entry 0x0200 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x00007f00; truncating the entry
Warning: Directory Image, entry 0x0100 has unknown Exif (TIFF) type 2377; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0100 is out of bounds: Offset = 0x00000100, size = 131401, exceeds buffer size by 130945 Bytes; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 514; setting type size 1.
Error: Directory Image, entry 0x0200 has invalid size 4143941632*1; skipping entry.
Warning: Directory Image, entry 0x0227 has unknown Exif (TIFF) type 1794; setting type size 1.
Error: Offset of directory Image, entry 0x0227 is out of bounds: Offset = 0x7f022202; truncating the entry
Warning: Directory Image, entry 0xefff has unknown Exif (TIFF) type 767; setting type size 1.
Error: Offset of directory Image, entry 0xefff is out of bounds: Offset = 0x02020202; truncating the entry
Warning: Directory Image, entry 0x1002 has unknown Exif (TIFF) type 6914; setting type size 1.
Error: Offset of directory Image, entry 0x1002 is out of bounds: Offset = 0x7f020202; truncating the entry
Warning: Directory Image, entry 0x4947 has unknown Exif (TIFF) type 14406; setting type size 1.
Error: Directory Image, entry 0x4947 has invalid size 587292985*1; skipping entry.
Warning: Directory Image, entry 0x0202 has unknown Exif (TIFF) type 32768; setting type size 1.
Error: Directory Image, entry 0x0202 has invalid size 2147680255*1; skipping entry.
Warning: Directory Image, entry 0x0201: Size or data offset value not set, ignoring them.
Warning: Directory Image, entry 0xfeff has unknown Exif (TIFF) type 256; setting type size 1.
Error: Offset of directory Image, entry 0xfeff is out of bounds: Offset = 0x0000fef5; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 18688; setting type size 1.
Error: Offset of directory Image, entry 0x0200 is out of bounds: Offset = 0x0201ff02; truncating the entry
Error: Directory Image, entry 0x0002 has invalid size 4278125129*1; skipping entry.
Error: Directory Image, entry 0x8825 Sub-IFD pointer 3 is out of bounds; ignoring it.
Error: Directory GPSInfo with 257 entries considered invalid; not read.
Error: Directory Iop with 18761 entries considered invalid; not read.
exiv2: tiffvisitor.cpp:1299: virtual void Exiv2::Internal::TiffReader::visitDirectory(Exiv2::Internal::TiffDirectory *): Assertion `tc.get()' failed.
Aborted


GDB debugging information is as follows:
(gdb) set args POC
(gdb) b tiffvisitor.cpp:1299 
Breakpoint 1 at 0x7ffff75c08bd: file tiffvisitor.cpp, line 1299.
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/icy/real/exiv2-trunk/install/bin/exiv2 ../output/crashes/id:000034,sig:06,src:004666,op:int32,pos:198,val:be:+100
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
invalid type value detected in Image::printIFDStructure:  0

Breakpoint 1, Exiv2::Internal::TiffReader::visitDirectory (this=0x7fffffffd490, object=0x68c1b0) at tiffvisitor.cpp:1299
1299	            assert(tc.get());
(gdb) c 42 
Will ignore next 41 crossings of breakpoint 1.  Continuing.
Error: Directory Image: Next pointer is out of bounds; ignored.
Warning: Directory Image, entry 0x0002 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0002 is out of bounds: Offset = 0x00000002, size = 65540, exceeds buffer size by 64830 Bytes; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 497; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x02297fba; truncating the entry
Warning: Directory Image, entry 0x4900 has unknown Exif (TIFF) type 18697; setting type size 1.
Error: Directory Image, entry 0x4900 has invalid size 524428033*1; skipping entry.
Warning: Directory Image, entry 0x8000 has unknown Exif (TIFF) type 65535; setting type size 1.
Error: Offset of directory Image, entry 0x8000 is out of bounds: Offset = 0xff7f0222; truncating the entry
Warning: Directory Image, entry 0x02ef has unknown Exif (TIFF) type 0; setting type size 1.
Error: Directory Image, entry 0x02ef has invalid size 1325435904*1; skipping entry.
Error: Offset of directory Image, entry 0x0149 is out of bounds: Offset = 0x03020200; truncating the entry
Warning: Directory Image, entry 0x8800 has unknown Exif (TIFF) type 65279; setting type size 1.
Warning: Directory Image, entry 0xff02 has unknown Exif (TIFF) type 4866; setting type size 1.
Error: Offset of directory Image, entry 0xff02 is out of bounds: Offset = 0x00007f00; truncating the entry
Warning: Directory Image, entry 0x0100 has unknown Exif (TIFF) type 2377; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0100 is out of bounds: Offset = 0x00000100, size = 131401, exceeds buffer size by 130945 Bytes; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 514; setting type size 1.
Error: Directory Image, entry 0x0200 has invalid size 4278125056*1; skipping entry.
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x490a4901; truncating the entry
Warning: Directory Image, entry 0x0201 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0201 is out of bounds: Offset = 0x02020000; truncating the entry
Warning: Directory Image, entry 0x0002 has unknown Exif (TIFF) type 65416; setting type size 1.
Error: Directory Image, entry 0x0002 has invalid size 284819469*1; skipping entry.
Warning: Directory Image, entry 0x0207 has unknown Exif (TIFF) type 767; setting type size 1.
Error: Offset of directory Image, entry 0x0207 is out of bounds: Offset = 0x007f5d00; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 18689; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x00010000; truncating the entry
Warning: Directory Image, entry 0x0000 has unknown Exif (TIFF) type 0; setting type size 1.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x02020000; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 511; setting type size 1.
Error: Offset of directory Image, entry 0x0200 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x01010101; truncating the entry
Warning: Directory Image, entry 0x0101 has unknown Exif (TIFF) type 257; setting type size 1.
Error: Offset of directory Image, entry 0x0101 is out of bounds: Offset = 0x00007f00; truncating the entry
Warning: Directory Image, entry 0x0100 has unknown Exif (TIFF) type 2377; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x0100 is out of bounds: Offset = 0x00000100, size = 131401, exceeds buffer size by 130945 Bytes; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 514; setting type size 1.
Error: Directory Image, entry 0x0200 has invalid size 4143941632*1; skipping entry.
Warning: Directory Image, entry 0x0227 has unknown Exif (TIFF) type 1794; setting type size 1.
Error: Offset of directory Image, entry 0x0227 is out of bounds: Offset = 0x7f022202; truncating the entry
Warning: Directory Image, entry 0xefff has unknown Exif (TIFF) type 767; setting type size 1.
Error: Offset of directory Image, entry 0xefff is out of bounds: Offset = 0x02020202; truncating the entry
Warning: Directory Image, entry 0x1002 has unknown Exif (TIFF) type 6914; setting type size 1.
Error: Offset of directory Image, entry 0x1002 is out of bounds: Offset = 0x7f020202; truncating the entry
Warning: Directory Image, entry 0x4947 has unknown Exif (TIFF) type 14406; setting type size 1.
Error: Directory Image, entry 0x4947 has invalid size 587292985*1; skipping entry.
Warning: Directory Image, entry 0x0202 has unknown Exif (TIFF) type 32768; setting type size 1.
Error: Directory Image, entry 0x0202 has invalid size 2147680255*1; skipping entry.
Warning: Directory Image, entry 0x0201: Size or data offset value not set, ignoring them.
Warning: Directory Image, entry 0xfeff has unknown Exif (TIFF) type 256; setting type size 1.
Error: Offset of directory Image, entry 0xfeff is out of bounds: Offset = 0x0000fef5; truncating the entry
Warning: Directory Image, entry 0x0200 has unknown Exif (TIFF) type 18688; setting type size 1.
Error: Offset of directory Image, entry 0x0200 is out of bounds: Offset = 0x0201ff02; truncating the entry
Error: Directory Image, entry 0x0002 has invalid size 4278125129*1; skipping entry.
Error: Directory Image, entry 0x8825 Sub-IFD pointer 3 is out of bounds; ignoring it.
Error: Directory GPSInfo with 257 entries considered invalid; not read.
Error: Directory Iop with 18761 entries considered invalid; not read.

Breakpoint 1, Exiv2::Internal::TiffReader::visitDirectory (this=0x7fffffffd490, object=0x68b020) at tiffvisitor.cpp:1299
1299	            assert(tc.get());
(gdb) n
exiv2: tiffvisitor.cpp:1299: virtual void Exiv2::Internal::TiffReader::visitDirectory(Exiv2::Internal::TiffDirectory *): Assertion `tc.get()' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff66901c7 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
55	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) 
(gdb) bt
#0  0x00007ffff66901c7 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007ffff6691e2a in __GI_abort () at abort.c:89
#2  0x00007ffff66890bd in __assert_fail_base (fmt=0x7ffff67eaf78 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7ffff770d9d2 "tc.get()", file=file@entry=0x7ffff770ccc2 "tiffvisitor.cpp", 
    line=line@entry=1299, 
    function=function@entry=0x7ffff770d8d7 "virtual void Exiv2::Internal::TiffReader::visitDirectory(Exiv2::Internal::TiffDirectory *)") at assert.c:92
#3  0x00007ffff6689172 in __GI___assert_fail (assertion=0x7ffff770d9d2 "tc.get()", 
    file=0x7ffff770ccc2 "tiffvisitor.cpp", line=1299, 
    function=0x7ffff770d8d7 "virtual void Exiv2::Internal::TiffReader::visitDirectory(Exiv2::Internal::TiffDirectory *)") at assert.c:101
#4  0x00007ffff75c17ba in Exiv2::Internal::TiffReader::visitDirectory (this=<optimized out>, object=<optimized out>)
    at tiffvisitor.cpp:1299
#5  0x00007ffff758842a in Exiv2::Internal::TiffDirectory::doAccept (this=0x68b020, visitor=...) at tiffcomposite.cpp:916
#6  0x00007ffff758883d in Exiv2::Internal::TiffComponent::accept (this=0x68b020, visitor=...) at tiffcomposite.cpp:891
#7  Exiv2::Internal::TiffSubIfd::doAccept (this=0x68b290, visitor=...) at tiffcomposite.cpp:931
#8  0x00007ffff758850c in Exiv2::Internal::TiffComponent::accept (this=0x68b290, visitor=...) at tiffcomposite.cpp:891
#9  Exiv2::Internal::TiffDirectory::doAccept (this=0x68c1b0, visitor=...) at tiffcomposite.cpp:919
#10 0x00007ffff7588268 in Exiv2::Internal::TiffComponent::accept (this=0x68c1b0, visitor=...) at tiffcomposite.cpp:891
#11 0x00007ffff759f7d4 in Exiv2::Internal::TiffParserWorker::parse (pData=<optimized out>, size=<optimized out>, 
    root=<optimized out>, pHeader=<optimized out>) at tiffimage.cpp:2011
#12 0x00007ffff759bf9f in Exiv2::Internal::TiffParserWorker::decode (exifData=..., iptcData=..., xmpData=..., 
    pData=0x7ffff7ff4000 "II*", size=712, root=131072, findDecoderFct=0x2c8, pHeader=<optimized out>)
    at tiffimage.cpp:1900
---Type <return> to continue, or q <return> to quit---
#13 0x00007ffff75995fa in Exiv2::TiffParser::decode (exifData=..., iptcData=..., xmpData=..., 
    pData=0x7ffff7ff4000 "II*", size=712) at tiffimage.cpp:260
#14 Exiv2::TiffImage::readMetadata (this=0x68c000) at tiffimage.cpp:192
#15 0x0000000000426ecb in Action::Print::printSummary (this=0x68bd10) at actions.cpp:289
#16 0x0000000000426a4c in Action::Print::run (this=0x68bd10, path=...) at actions.cpp:244
#17 0x00000000004078c0 in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170

This vulnerability was triggered after the TiffReader::visitDirectory(TiffDirectory* object) at tiffvisitor.cpp:1299

1260     void TiffReader::visitDirectory(TiffDirectory* object)
 ...
1286         for (uint16_t i = 0; i < n; ++i) {
1287             if (p + 12 > pLast_) {
1288 #ifndef SUPPRESS_WARNINGS
1289                 EXV_ERROR << "Directory " << groupName(object->group())
1290                           << ": IFD entry " << i
1291                           << " lies outside of the data buffer.\n";
1292 #endif
1293                 return;
1294             }
1295             uint16_t tag = getUShort(p, byteOrder());
1296             TiffComponent::AutoPtr tc = TiffCreator::create(tag, object->group());
1297             // The assertion typically fails if a component is not configured in
1298             // the TIFF structure table
1299             assert(tc.get());
1300             tc->setStart(p);
1301             object->addChild(tc);
1302             p += 12;
1303         }
 ...

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Problem: intalling on OS X

I try to instal the project but configure doesn't work :

➜ exiv2 git:(master) ./configure
zsh: no such file or directory: ./configure
➜ exiv2 git:(master) make config
cd config && /Applications/Xcode.app/Contents/Developer/usr/bin/make -f config.make config
autoconf -o ../configure
make[1]: autoconf: No such file or directory
make[1]: *** [config] Error 1
make: *** [config] Error 2
➜ exiv2 git:(master) make
Makefile:163: *** File config/config.mk does not exist. Did you run ./configure?. Stop.
➜ exiv2 git:(master)

What am I doing wrong ?

Error reading TIFF image: "tiff directory length is too large"

I have this error when trying to read an EXIF image I could perfectly read with the version 0.25:

$ ./exiv2 /tmp/tetracam_image.tif 
Exiv2 exception in print action for file /tmp/tetracam_image.tif:
tiff directory length is too large

I attach the image here so you can analyse the issue. This will block me to update the Exiv2 version in my software

Invalid memory address dereference in Exiv2::StringValueBase::read ( in value.cpp:302)

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1494780

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1329794

Here's a copy of the report:

Liu Zhu 2017-09-22 22:04:33 EDT
Created attachment 1329794 [details]
PoC File

./exiv2 005-invalid-mem
Warning: Directory Image, entry 0x011a has unknown Exif (TIFF) type 64772; setting type size 1.
Error: Upper boundary of data for directory Image, entry 0x011b is out of bounds: Offset = 0x00000030, size = 1073741832, exceeds buffer size by 1073734073 Bytes; truncating the entry
Error: Upper boundary of data for directory Photo, entry 0x9003 is out of bounds: Offset = 0x000001f8, size = 3538992, exceeds buffer size by 3531689 Bytes; truncating the entry
Warning: Directory Nikon3 has an unexpected next pointer; ignored.
ASAN:SIGSEGV

==11802==ERROR: AddressSanitizer: SEGV on unknown address 0x62410000c2c3 (pc 0x7f69ca832cf0 bp 0x7ffc8db8ae20 sp 0x7ffc8db8a5a8 T0)
#0 0x7f69ca832cef (/lib/x86_64-linux-gnu/libc.so.6+0x160cef)
#1 0x7f69cbb125d0 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c5d0)
#2 0x7f69cadd3b06 in void std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_construct<char const*>(char const*, char const*, std::forward_iterator_tag) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x121b06)
#3 0x7f69cadd3c04 in std::__cxx11::basic_string<char, std::char_traits, std::allocator >::basic_string(char const*, unsigned long, std::allocator const&) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x121c04)
#4 0x7f69cb4a9057 in Exiv2::StringValueBase::read(unsigned char const*, long, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/value.cpp:302
#5 0x7f69cb498d08 in Exiv2::Internal::TiffReader::readTiffEntry(Exiv2::Internal::TiffEntryBase*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1541
#6 0x7f69cb4954be in Exiv2::Internal::TiffReader::visitEntry(Exiv2::Internal::TiffEntry*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1204
#7 0x7f69cb46397c in Exiv2::Internal::TiffEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:896
#8 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#9 0x7f69cb463cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#10 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#11 0x7f69cb464351 in Exiv2::Internal::TiffIfdMakernote::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:949
#12 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#13 0x7f69cb4641bf in Exiv2::Internal::TiffMnEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:938
#14 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#15 0x7f69cb463cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#16 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#17 0x7f69cb46407e in Exiv2::Internal::TiffSubIfd::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:931
#18 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#19 0x7f69cb463cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#20 0x7f69cb463909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#21 0x7f69cb47c451 in Exiv2::Internal::TiffParserWorker::parse(unsigned char const*, unsigned int, unsigned int, Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:2011
#22 0x7f69cb47b267 in Exiv2::Internal::TiffParserWorker::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int, unsigned int, void (Exiv2::Internal::TiffDecoder::()(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, unsigned int, Exiv2::Internal::IfdId))(Exiv2::Internal::TiffEntryBase const*), Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:1900
#23 0x7f69cb479a82 in Exiv2::TiffParser::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:266
#24 0x7f69cb37643e in Exiv2::ExifParser::decode(Exiv2::ExifData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/exif.cpp:629
#25 0x7f69cb3b6030 in Exiv2::JpegBase::readMetadata() /root/fuzzing/exiv2-trunk/src/jpgimage.cpp:386
#26 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
#27 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
#28 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
#29 0x7f69ca6f282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#30 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==11802==ABORTING
[reply] [−] Comment 2 Liu Zhu 2017-09-23 01:15:42 EDT
./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

CVE-2017-11340: Segmentation fault in the XmpParser::terminate() function

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1470950

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1298135
(it's a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC6
ORF IMAGE
Error: Directory Image, entry 0x0000 has invalid size 4294967295*1; skipping entry.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x7e000000; truncating the entry
Error: Offset of directory Image, entry 0x0111 is out of bounds: Offset = 0x7e000000; truncating the entry
File name       : id:000023,sig:06,src:001147+000847,op:splice,rep:2
File size       : 60 Bytes
MIME type       : image/x-olympus-orf
Image size      : 0 x 0
Camera make     : 
Camera model    : 
Image timestamp : 
Image number    : 
Exposure time   : 
Aperture        : 
Exposure bias   : 
Flash           : 
Flash bias      : 
Focal length    : 
Subject distance: 
ISO speed       : 
Exposure mode   : 
Metering mode   : 
Macro mode      : 
Image quality   : 
Exif Resolution : 
White balance   : 
Thumbnail       : None
Copyright       : 
Exif comment    : 

Segmentation fault


GDB debugging information is as follows:
(gdb) set args POC6
(gdb) r
 ...
Continuing.
ORF IMAGE
Error: Directory Image, entry 0x0000 has invalid size 4294967295*1; skipping entry.
Error: Offset of directory Image, entry 0x0000 is out of bounds: Offset = 0x7e000000; truncating the entry
Error: Offset of directory Image, entry 0x0111 is out of bounds: Offset = 0x7e000000; truncating the entry
File name       : id:000023,sig:06,src:001147+000847,op:splice,rep:2
File size       : 60 Bytes
MIME type       : image/x-olympus-orf
Image size      : 0 x 0
Camera make     : 
Camera model    : 
Image timestamp : 
Image number    : 
Exposure time   : 
Aperture        : 
Exposure bias   : 
Flash           : 
Flash bias      : 
Focal length    : 
Subject distance: 
ISO speed       : 
Exposure mode   : 
Metering mode   : 
Macro mode      : 
Image quality   : 
Exif Resolution : 
White balance   : 
Thumbnail       : None
Copyright       : 
Exif comment    : 


Breakpoint 3, main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:176
176	    Exiv2::XmpParser::terminate();
(gdb) n
155	    Action::Task::AutoPtr task
(gdb) n
180	} // main
(gdb) 

Breakpoint 2, __libc_start_main (main=0x4e24c0 <main(int, char* const*)>, argc=2, argv=0x7fffffffe598, 
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe588) at libc-start.c:323
323	libc-start.c: No such file or directory.
(gdb) s
__GI_exit (status=0) at exit.c:104
104	exit.c: No such file or directory.
(gdb) n
103	in exit.c
(gdb) 
104	in exit.c
(gdb) 

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) 

This vulnerability was triggered after the function __GI_exit (status=0) exit.c:104 after function main() exit.

CVE-2017-11337: invalid free in the Action::TaskFactory::cleanup function

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1470737

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1297689
(it's a rar archive containing the file used to reproduce the issue)

Here's a copy of the report:

There is an invalid free in Action::TaskFactory::cleanup funtion of actions.cpp in exiv2. A crafted input will lead to remote denial of service attack.

$./exiv2 POC3

*** Error in `/real/exiv2/bin/.libs/lt-exiv2': malloc(): memory corruption: 0x0000000000bac250 ***
Aborted

ASAN output information:

$./exiv2 POC3

Error: Directory Image, entry 0x0144 has invalid size 4294967295*8; skipping entry.
File name       : POC3
File size       : 28 Bytes
MIME type       : image/tiff
Image size      : 0 x 0
POC3 No Exif data found in the file
=================================================================
==92908==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x60200000ed90 in thread T0
    #0 0x4e1c92  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1c92)
    #1 0x51515c  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x51515c)
    #2 0x4e2fe6  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2fe6)
    #3 0x7fbeb19e9abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #4 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000ed90 is located 0 bytes inside of 1229389824-byte region [0x60200000ed90,0x60204947ed90)
freed by thread T0 here:
==92908==AddressSanitizer CHECK failed: /build/llvm-toolchain-3.6-18MJNr/llvm-toolchain-3.6-3.6.2/projects/compiler-rt/lib/asan/asan_allocator.cc:668 "((res.trace)) != (0)" (0x0, 0x0)
    #0 0x4c9dd4  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c9dd4)
    #1 0x4d0751  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4d0751)
    #2 0x43b8c8  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b8c8)
    #3 0x4c5d70  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c5d70)
    #4 0x4c6b9f  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c6b9f)
    #5 0x43f5d5  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43f5d5)
    #6 0x43bc87  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43bc87)
    #7 0x4e1d51  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1d51)
    #8 0x51515c  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x51515c)
    #9 0x4e2fe6  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2fe6)
    #10 0x7fbeb19e9abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #11 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

The GDB debugging information is as follows:

(gdb) set args POC3
(gdb) r
...
(gdb) 
Continuing.

Breakpoint 2, Action::TaskFactory::cleanup (this=<optimized out>) at actions.cpp:194
194	                delete i->second;

(gdb) bt
#0  Action::TaskFactory::cleanup (this=<optimized out>) at actions.cpp:194
#1  0x00000000004e2fe7 in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:174
(gdb) s
=================================================================
==114915==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x60200000edb0 in thread T0
    #0 0x4e1c92  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1c92)
    #1 0x51515c  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x51515c)
    #2 0x4e2fe6  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2fe6)
    #3 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #4 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60200000edb0 is located 0 bytes inside of 1229389824-byte region [0x60200000edb0,0x60204947edb0)
freed by thread T0 here:
==114915==AddressSanitizer CHECK failed: /build/llvm-toolchain-3.6-18MJNr/llvm-toolchain-3.6-3.6.2/projects/compiler-rt/lib/asan/asan_allocator.cc:668 "((res.trace)) != (0)" (0x0, 0x0)
    #0 0x4c9dd4  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c9dd4)
    #1 0x4d0751  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4d0751)
    #2 0x43b8c8  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b8c8)
    #3 0x4c5d70  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c5d70)
    #4 0x4c6b9f  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4c6b9f)
    #5 0x43f5d5  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43f5d5)
    #6 0x43bc87  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43bc87)
    #7 0x4e1d51  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1d51)
    #8 0x51515c  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x51515c)
    #9 0x4e2fe6  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2fe6)
    #10 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #11 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

[Inferior 1 (process 114915) exited with code 01]

This vulnerability was triggered in Action::TaskFactory::cleanup() at actions.cpp:194. Line 194 attempting free on address which was not malloc()-ed: 0x60200000edb0

 189     void TaskFactory::cleanup()
 190     {
 191         if (instance_ != 0) {
 192             Registry::iterator e = registry_.end();
 193             for (Registry::iterator i = registry_.begin(); i != e; ++i) {
 194                 delete i->second;
 195             }
 196             delete instance_;
 197             instance_ = 0;
 198         }
 199     } //TaskFactory::cleanup

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

Consider using a different regression test suite

The current regression test script has some problems for managing it with git:

  1. The regressions are added into a single file
  2. The test results are added into a single binary file

Both make cherry-picking new commits onto old ones to backport changes quite cumbersome, especially the binary file, as git can't diff binary files. It would be a lot better if we would split the test file into lots of single files where each of them tests one single issue. This would make backporting very easy.

Please make a new release

I am trying to make a vcpkg port for exiv2 and currently the v0.26 release does not compile with the standard

cd exiv2
mkdir build
cd build
cmake -A x64 ..
msbuild exiv2.sln /p:Configuration=Release

However, the current master does compiles successfully. Therefore, could you make a new release with the current master for vcpkg users? Thank you very much.

It is a heap-buffer-overflow in Exiv2::Jp2Image::readMetadata (jp2image.cpp:277)

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1494776

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1329790

Here's a copy of the report:

Liu Zhu 2017-09-22 21:39:03 EDT
Created attachment 1329790 [details]
PoC File

./exiv2 003-heap-buffer-over

==34506==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000be69 at pc 0x7fa4854c3935 bp 0x7ffdf8967ef0 sp 0x7ffdf8967698
READ of size 808464432 at 0x61200000be69 thread T0
#0 0x7fa4854c3934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)
#1 0x7fa484d5f07c in Exiv2::Jp2Image::readMetadata() /root/fuzzing/exiv2-trunk/src/jp2image.cpp:277
#2 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
#3 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
#4 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
#5 0x7fa4840a382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#6 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8)

0x61200000be69 is located 0 bytes to the right of 297-byte region [0x61200000bd40,0x61200000be69)
allocated by thread T0 here:
#0 0x7fa4854d06b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
#1 0x454805 in Exiv2::DataBuf::DataBuf(long) /root/fuzzing/exiv2-trunk/include/exiv2/types.hpp:204
#2 0x7fa484d5ef9a in Exiv2::Jp2Image::readMetadata() /root/fuzzing/exiv2-trunk/src/jp2image.cpp:273
#3 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
#4 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
#5 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
#6 0x7fa4840a382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
0x0c247fff9770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff9780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff9790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff97a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff97b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff97c0: 00 00 00 00 00 00 00 00 00 00 00 00 00[01]fa fa
0x0c247fff97d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff97e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff97f0: 00 00 00 00 00 00 00 00 00 00 00 01 fa fa fa fa
0x0c247fff9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==34506==ABORTING
[reply] [−] Comment 2 Liu Zhu 2017-09-23 01:15:31 EDT
./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

Linking with static expat

I don't know if this the place to ask this or not. I've been trying to build Exiv2 with static zlib and static expat in MSVC 2015 Win64.

I was able to build it with static zlib but if I tried to link it with static Expat, I'd get linker errors. exiv2 with static zlib and expat even possible?

Code implementaiton

I am creating a photo library organizer and would like to expand it and support all media files.
Your project is basically a miracle and would like to implement it in my code.

Is there a way to do so and implement your project to mine ?

Thank you.

Invalid memory address dereference in Exiv2::DataValue::read (value.cpp:193)

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1494786

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1329797

Here's a copy of the report:

Liu Zhu 2017-09-22 22:48:12 EDT
Created attachment 1329797 [details]
PoC File

./exiv2 008-invalid-mem
Warning: Directory Image, entry 0xff13 has unknown Exif (TIFF) type 65535; setting type size 1.
Error: Offset of directory Image, entry 0xff13 is out of bounds: Offset = 0x30303030; truncating the entry
Warning: Directory Photo has an unexpected next pointer; ignored.
Error: Offset of directory Photo, entry 0x8827 is out of bounds: Offset = 0x30303030; truncating the entry
Error: Directory Photo, entry 0x9204 has invalid size 4286513153*8; skipping entry.
Warning: Directory Nikon3 has an unexpected next pointer; ignored.
Error: Upper boundary of data for directory Nikon3, entry 0x0004 is out of bounds: Offset = 0x00000170, size = 1376264, exceeds buffer size by 1369403 Bytes; truncating the entry
Error: Offset of directory Nikon3, entry 0x0006 is out of bounds: Offset = 0x0000e803; truncating the entry
Error: Directory NikonPreview with 12336 entries considered invalid; not read.
Warning: Directory Nikon3, entry 0x0095 has unknown Exif (TIFF) type 2562; setting type size 1.
Error: Offset of directory Nikon3, entry 0x009c is out of bounds: Offset = 0x000ffff8; truncating the entry
ASAN:SIGSEGV

==33537==ERROR: AddressSanitizer: SEGV on unknown address 0x62410000c272 (pc 0x7f40f6995960 bp 0x7ffcb5b71620 sp 0x7ffcb5b70da8 T0)
#0 0x7f40f699595f (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xaa95f)
#1 0x7f40f6977e8d in __asan_memmove (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8ce8d)
#2 0x7f40f61b9ada in unsigned char* std::__copy_move<false, true, std::random_access_iterator_tag>::__copy_m(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_algobase.h:384
#3 0x7f40f6289d9a in unsigned char* std::__copy_move_a<false, unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_algobase.h:402
#4 0x7f40f6289291 in unsigned char* std::__copy_move_a2<false, unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_algobase.h:440
#5 0x7f40f6288fa0 in unsigned char* std::copy<unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_algobase.h:472
#6 0x7f40f631c763 in unsigned char* std::__uninitialized_copy::__uninit_copy<unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_uninitialized.h:93
#7 0x7f40f631bde5 in unsigned char* std::uninitialized_copy<unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/5/bits/stl_uninitialized.h:126
#8 0x7f40f631b353 in unsigned char* std::__uninitialized_copy_a<unsigned char const*, unsigned char*, unsigned char>(unsigned char const*, unsigned char const*, unsigned char*, std::allocator&) /usr/include/c++/5/bits/stl_uninitialized.h:281
#9 0x7f40f631b270 in unsigned char* std::vector<unsigned char, std::allocator >::_M_allocate_and_copy<unsigned char const*>(unsigned long, unsigned char const*, unsigned char const*) /usr/include/c++/5/bits/stl_vector.h:1227
#10 0x7f40f6319f66 in void std::vector<unsigned char, std::allocator >::_M_assign_aux<unsigned char const*>(unsigned char const*, unsigned char const*, std::forward_iterator_tag) /usr/include/c++/5/bits/vector.tcc:273
#11 0x7f40f63190d5 in void std::vector<unsigned char, std::allocator >::_M_assign_dispatch<unsigned char const*>(unsigned char const*, unsigned char const*, std::__false_type) /usr/include/c++/5/bits/stl_vector.h:1336
#12 0x7f40f6317cf1 in void std::vector<unsigned char, std::allocator >::assign<unsigned char const*>(unsigned char const*, unsigned char const*) /usr/include/c++/5/bits/stl_vector.h:516
#13 0x7f40f630d2ec in Exiv2::DataValue::read(unsigned char const*, long, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/value.cpp:193
#14 0x7f40f62fdd08 in Exiv2::Internal::TiffReader::readTiffEntry(Exiv2::Internal::TiffEntryBase*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1541
#15 0x7f40f62fa4be in Exiv2::Internal::TiffReader::visitEntry(Exiv2::Internal::TiffEntry*) /root/fuzzing/exiv2-trunk/src/tiffvisitor.cpp:1204
#16 0x7f40f62c897c in Exiv2::Internal::TiffEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:896
#17 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#18 0x7f40f62c8cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#19 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#20 0x7f40f62c9351 in Exiv2::Internal::TiffIfdMakernote::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:949
#21 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#22 0x7f40f62c91bf in Exiv2::Internal::TiffMnEntry::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:938
#23 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#24 0x7f40f62c8cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#25 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#26 0x7f40f62c907e in Exiv2::Internal::TiffSubIfd::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:931
#27 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#28 0x7f40f62c8cc2 in Exiv2::Internal::TiffDirectory::doAccept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:919
#29 0x7f40f62c8909 in Exiv2::Internal::TiffComponent::accept(Exiv2::Internal::TiffVisitor&) /root/fuzzing/exiv2-trunk/src/tiffcomposite.cpp:891
#30 0x7f40f62e1451 in Exiv2::Internal::TiffParserWorker::parse(unsigned char const*, unsigned int, unsigned int, Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:2011
#31 0x7f40f62e0267 in Exiv2::Internal::TiffParserWorker::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int, unsigned int, void (Exiv2::Internal::TiffDecoder::()(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, unsigned int, Exiv2::Internal::IfdId))(Exiv2::Internal::TiffEntryBase const*), Exiv2::Internal::TiffHeaderBase*) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:1900
#32 0x7f40f62dea82 in Exiv2::TiffParser::decode(Exiv2::ExifData&, Exiv2::IptcData&, Exiv2::XmpData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:266
#33 0x7f40f61db43e in Exiv2::ExifParser::decode(Exiv2::ExifData&, unsigned char const*, unsigned int) /root/fuzzing/exiv2-trunk/src/exif.cpp:629
#34 0x7f40f621b030 in Exiv2::JpegBase::readMetadata() /root/fuzzing/exiv2-trunk/src/jpgimage.cpp:386
#35 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
#36 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
#37 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
#38 0x7f40f555782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#39 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==33537==ABORTING
[reply] [−] Comment 2 Liu Zhu 2017-09-23 01:15:54 EDT
./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

CVE-2017-12955: heap-based buffer overflow in basicio.cpp

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1482295

The reproducer file is here:
https://bugzilla.redhat.com/attachment.cgi?id=1314498
(it's a rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC11
ORF IMAGE
*** Error in `./../../../exiv2': malloc(): memory corruption (fast): 0x00000000025be540 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fd3b91c57e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82651)[0x7fd3b91d0651]
/lib/x86_64-linux-gnu/libc.so.6(__libc_malloc+0x54)[0x7fd3b91d2184]
/usr/lib/x86_64-linux-gnu/libstdc++.so.6(_Znwm+0x18)[0x7fd3b9ac4e78]
/usr/lib/x86_64-linux-gnu/libstdc++.so.6(_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_+0x9f)[0x7fd3b9b563df]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(+0x18c9f1)[0x7fd3b9f459f1]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image17printIFDStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEjbci+0x20c2)[0x7fd3b9f41652]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv25Image18printTiffStructureERNS_7BasicIoERSoNS_20PrintStructureOptionEim+0x12a)[0x7fd3b9f460fa]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv28OrfImage12readMetadataEv+0x162)[0x7fd3b9fd72c2]
/home/icy/real/exiv2/install/lib/libexiv2.so.26(_ZN5Exiv28PgfImage12readMetadataEv+0x56b)[0x7fd3b9ff284b]
./../../../exiv2[0x4276f8]
./../../../exiv2[0x42727c]
./../../../exiv2[0x4073a0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fd3b916e830]
./../../../exiv2[0x406c89]
======= Memory map: ========
00400000-00467000 r-xp 00000000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00666000-00667000 r--p 00066000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00667000-00668000 rw-p 00067000 08:01 2262265                            /home/icy/real/exiv2/install/bin/exiv2
00668000-00678000 rw-p 00000000 00:00 0 
025a1000-025d3000 rw-p 00000000 00:00 0                                  [heap]
7fd3b4000000-7fd3b4021000 rw-p 00000000 00:00 0 
7fd3b4021000-7fd3b8000000 ---p 00000000 00:00 0 
7fd3b8a33000-7fd3b8d0b000 r--p 00000000 08:01 1048676                    /usr/lib/locale/locale-archive
7fd3b8d0b000-7fd3b8d31000 r-xp 00000000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7fd3b8d31000-7fd3b8f31000 ---p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7fd3b8f31000-7fd3b8f33000 r--p 00026000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7fd3b8f33000-7fd3b8f34000 rw-p 00028000 08:01 529101                     /lib/x86_64-linux-gnu/libexpat.so.1.6.0
7fd3b8f34000-7fd3b8f4d000 r-xp 00000000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7fd3b8f4d000-7fd3b914c000 ---p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7fd3b914c000-7fd3b914d000 r--p 00018000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7fd3b914d000-7fd3b914e000 rw-p 00019000 08:01 529399                     /lib/x86_64-linux-gnu/libz.so.1.2.8
7fd3b914e000-7fd3b930e000 r-xp 00000000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7fd3b930e000-7fd3b950e000 ---p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7fd3b950e000-7fd3b9512000 r--p 001c0000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7fd3b9512000-7fd3b9514000 rw-p 001c4000 08:01 536305                     /lib/x86_64-linux-gnu/libc-2.23.so
7fd3b9514000-7fd3b9518000 rw-p 00000000 00:00 0 
7fd3b9518000-7fd3b952e000 r-xp 00000000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd3b952e000-7fd3b972d000 ---p 00016000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd3b972d000-7fd3b972e000 rw-p 00015000 08:01 529515                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd3b972e000-7fd3b9836000 r-xp 00000000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7fd3b9836000-7fd3b9a35000 ---p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7fd3b9a35000-7fd3b9a36000 r--p 00107000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7fd3b9a36000-7fd3b9a37000 rw-p 00108000 08:01 536300                     /lib/x86_64-linux-gnu/libm-2.23.so
7fd3b9a37000-7fd3b9ba9000 r-xp 00000000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7fd3b9ba9000-7fd3b9da9000 ---p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7fd3b9da9000-7fd3b9db3000 r--p 00172000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7fd3b9db3000-7fd3b9db5000 rw-p 0017c000 08:01 1059188                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7fd3b9db5000-7fd3b9db9000 rw-p 00000000 00:00 0 
7fd3b9db9000-7fd3ba261000 r-xp 00000000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7fd3ba261000-7fd3ba461000 ---p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7fd3ba461000-7fd3ba492000 r--p 004a8000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7fd3ba492000-7fd3ba494000 rw-p 004d9000 08:01 2262257                    /home/icy/real/exiv2/install/lib/libexiv2.so.26.0.0
7fd3ba494000-7fd3ba4b0000 rw-p 00000000 00:00 0 
7fd3ba4b0000-7fd3ba4c8000 r-xp 00000000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7fd3ba4c8000-7fd3ba6c7000 ---p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7fd3ba6c7000-7fd3ba6c8000 r--p 00017000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7fd3ba6c8000-7fd3ba6c9000 rw-p 00018000 08:01 536288                     /lib/x86_64-linux-gnu/libpthread-2.23.so
7fd3ba6c9000-7fd3ba6cd000 rw-p 00000000 00:00 0 
7fd3ba6cd000-7fd3ba6d0000 r-xp 00000000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7fd3ba6d0000-7fd3ba8cf000 ---p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7fd3ba8cf000-7fd3ba8d0000 r--p 00002000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7fd3ba8d0000-7fd3ba8d1000 rw-p 00003000 08:01 536294                     /lib/x86_64-linux-gnu/libdl-2.23.so
7fd3ba8d1000-7fd3ba8f7000 r-xp 00000000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7fd3baace000-7fd3baad6000 rw-p 00000000 00:00 0 
7fd3baaf3000-7fd3baaf6000 rw-p 00000000 00:00 0 
7fd3baaf6000-7fd3baaf7000 r--p 00025000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7fd3baaf7000-7fd3baaf8000 rw-p 00026000 08:01 536281                     /lib/x86_64-linux-gnu/ld-2.23.so
7fd3baaf8000-7fd3baaf9000 rw-p 00000000 00:00 0 
7ffc17508000-7ffc17529000 rw-p 00000000 00:00 0                          [stack]
7ffc175e1000-7ffc175e3000 r--p 00000000 00:00 0                          [vvar]
7ffc175e3000-7ffc175e5000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted

GDB debugging information is as follows:
(gdb) set args POC9
(gdb) r
 ...

Breakpoint 3, Exiv2::MemIo::read (this=<optimized out>, buf=0x7fffffffc5e0 "\003", rcount=2) at basicio.cpp:1281
1281	        std::memcpy(buf, &p_->data_[p_->idx_], allow);
(gdb) c 24 
Will ignore next 23 crossings of breakpoint 3.  Continuing.
ORF IMAGE

Breakpoint 3, Exiv2::MemIo::read (this=<optimized out>, buf=0x60300000d510 "", rcount=4294967295) at basicio.cpp:1281
1281	        std::memcpy(buf, &p_->data_[p_->idx_], allow);
(gdb) bt 
#0  Exiv2::MemIo::read (this=<optimized out>, buf=0x60300000d510 "", rcount=4294967295) at basicio.cpp:1281
#1  0x00007ffff70b0e79 in Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., 
    option=Exiv2::kpsRecursive, start=0, bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:408
#2  0x00007ffff70b90e1 in Exiv2::Image::printTiffStructure (this=0x61300000de80, io=..., out=..., 
    option=Exiv2::kpsRecursive, depth=-1, offset=<optimized out>) at image.cpp:518
#3  0x00007ffff71972ac in Exiv2::OrfImage::printStructure (this=<optimized out>, out=..., option=<optimized out>, 
    depth=<optimized out>) at orfimage.cpp:104
#4  0x00007ffff7198631 in Exiv2::OrfImage::readMetadata (this=<optimized out>) at orfimage.cpp:123
#5  0x00007ffff71c3df6 in Exiv2::PgfImage::readMetadata (this=<optimized out>) at pgfimage.cpp:152
#6  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#7  0x0000000000518489 in Action::Print::run (this=0x60400000da50, path=...) at actions.cpp:244
#8  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170
(gdb) n
=================================================================
==125397==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000d524 at pc 0x0000004ab7f6 bp 0x7fffffffbbf0 sp 0x7fffffffb3a0
WRITE of size 73 at 0x60300000d524 thread T0
    #0 0x4ab7f5  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4ab7f5)
    #1 0x7ffff6f5b74d  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x2df74d)
    #2 0x7ffff70b0e78  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434e78)
    #3 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #4 0x7ffff71972ab  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51b2ab)
    #5 0x7ffff7198630  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x51c630)
    #6 0x7ffff71c3df5  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x547df5)
    #7 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #8 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #9 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #10 0x7ffff5e29abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #11 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

0x60300000d524 is located 0 bytes to the right of 20-byte region [0x60300000d510,0x60300000d524)
allocated by thread T0 here:
    #0 0x4e1842  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e1842)
    #1 0x7ffff70b0c5f  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434c5f)
    #2 0x7ffff70b90e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)

Shadow bytes around the buggy address:
  0x0c067fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c067fff9aa0: fa fa 00 00[04]fa fa fa 00 00 00 07 fa fa 00 00
  0x0c067fff9ab0: 00 07 fa fa 00 00 00 07 fa fa 00 00 00 07 fa fa
  0x0c067fff9ac0: 00 00 00 07 fa fa 00 00 00 07 fa fa 00 00 00 07
  0x0c067fff9ad0: fa fa 00 00 00 07 fa fa 00 00 00 07 fa fa 00 00
  0x0c067fff9ae0: 00 07 fa fa 00 00 00 07 fa fa 00 00 00 07 fa fa
  0x0c067fff9af0: 00 00 00 07 fa fa 00 00 00 07 fa fa 00 00 00 07
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==125397==ABORTING
[Inferior 1 (process 125397) exited with code 01]

This vulnerability was triggered in Exiv2::Image::printIFDStructure () at basicio.cpp:1281.

1277	    long MemIo::read(byte* buf, long rcount)
1278	    {
1279	        long avail = EXV_MAX(p_->size_ - p_->idx_, 0);
1280	        long allow = EXV_MIN(rcount, avail);
1281	        std::memcpy(buf, &p_->data_[p_->idx_], allow);
1282	        p_->idx_ += allow;
1283	        if (rcount > avail) p_->eof_ = true;
1284	        return allow;
1285	    }

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

The '--quiet' option does not silence errors

For example: when I run exiv2 --quiet cabin.jpg, I get
File name : cabin.jpg File size : 142852 Bytes MIME type : image/jpeg Image size : 705 x 837 cabin.jpg: No Exif data found in the file

The last line is printing on stderr, so I expected --quiet to silence it. I am running GalliumOS(which is based on Ubuntu 16.04) on 64-bit x86 hardware, exiv2 version 0.26.

CVE-2017-11553: illegal address access in the extend_alias_table function in localealias.c

I'm forwarding a security vulnerability reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1471772

The file used to reproduce the issue is here:
https://bugzilla.redhat.com/attachment.cgi?id=1299839
(this is rar archive containing the actual reproducer file)

Here's a copy of the report:

$./exiv2 POC7

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff60f9135 in malloc_consolidate (av=av@entry=0x7ffff643ec00 <main_arena>) at malloc.c:4150
4150	malloc.c: No such file or directory.
(gdb) bt
#0  0x00007ffff60f9135 in malloc_consolidate (av=av@entry=0x7ffff643ec00 <main_arena>) at malloc.c:4150
#1  0x00007ffff60fba34 in _int_malloc (av=av@entry=0x7ffff643ec00 <main_arena>, bytes=bytes@entry=1600) at malloc.c:3417
#2  0x00007ffff60fe50e in __GI___libc_malloc (bytes=1600) at malloc.c:2895
#3  0x00007ffff60fffb8 in __libc_realloc (bytes=1600, oldmem=0x0) at malloc.c:2976
#4  realloc_hook_ini (ptr=0x0, sz=1600, caller=<optimized out>) at hooks.c:41
#5  0x00007ffff60fec17 in __GI___libc_realloc (oldmem=0x0, bytes=1600) at malloc.c:2965
#6  0x00007ffff60ac1cb in extend_alias_table () at localealias.c:397
#7  read_alias_file (fname=<optimized out>, fname_len=<optimized out>) at localealias.c:319
#8  0x00007ffff60ac3c7 in _nl_expand_alias (name=name@entry=0x7fffffffae30 "en_US.UTF-8") at localealias.c:203
#9  0x00007ffff60aa608 in _nl_find_domain (dirname=dirname@entry=0x7ffff620ea00 <_nl_default_dirname> "/usr/share/locale", locale=locale@entry=0x7fffffffae30 "en_US.UTF-8", 
    domainname=domainname@entry=0x7fffffffae50 "LC_MESSAGES/libc.mo", domainbinding=domainbinding@entry=0x0) at finddomain.c:124
#10 0x00007ffff60a9e72 in __dcigettext (domainname=0x7ffff6206229 <_libc_intl_domainname> "libc", msgid1=0x7ffff6206711 "Cannot allocate memory", msgid2=msgid2@entry=0x0, plural=plural@entry=0, 
    n=n@entry=0, category=category@entry=5) at dcigettext.c:722
#11 0x00007ffff60a8a8f in __GI___dcgettext (domainname=<optimized out>, msgid=<optimized out>, category=category@entry=5) at dcgettext.c:47
#12 0x00007ffff610558e in __GI___strerror_r (errnum=12, buf=0x7fffffffb0b0 "", buflen=1024) at _strerror.c:71
#13 0x00000000005706ef in Exiv2::strError() ()
#14 0x00000000004c11b8 in Exiv2::FileIo::mmap(bool) ()
#15 0x00000000006b8f3f in Exiv2::TiffImage::readMetadata() ()
#16 0x0000000000464434 in Action::Print::printSummary() ()
#17 0x0000000000463e5c in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
#18 0x0000000000439762 in main ()

icy@ubuntu:~/real/exiv2-asan/install/bin$ ./exiv2 ../../../exiv2_coll4/coll-out1/crashes/id\:000015\,sig\:11\,src\:001021\,op\:flip32\,pos\:47 
ASAN:SIGSEGV
=================================================================
==47987==ERROR: AddressSanitizer: SEGV on unknown address 0x00a09ffca08b (pc 0x7efe16b0fec5 bp 0x7ffca809dd00 sp 0x7ffca809d600 T0)
    #0 0x7efe16b0fec4  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x434ec4)
    #1 0x7efe16b180e0  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x43d0e0)
    #2 0x7efe16d28900  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x64d900)
    #3 0x7efe16d205eb  (/home/icy/real/exiv2-asan/install/lib/libexiv2.so.26+0x6455eb)
    #4 0x518d8b  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518d8b)
    #5 0x518488  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x518488)
    #6 0x4e2ebb  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x4e2ebb)
    #7 0x7efe15888abf  (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #8 0x43b288  (/home/icy/real/exiv2-asan/install/bin/exiv2+0x43b288)

AddressSanitizer can not provide additional info.
==47987==ABORTING

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact [email protected] and [email protected] if you need more info about the team, the tool or the vulnerability.

(false alarm) overflow exploit on 0.25 001900 64bit

I was looking at a photo taken with an Android phone this morning and it appeared to trigger an overflow exploit after hitting the comment block.

I know 0.25 is an older version, but I was wondering if this is/was a known issue? A quick search seems to indicate that EXIF exploits were pretty popular last year, but the build I am running is the version currently packaged with Arch Linux. I would not be surprised to learn other distros ship that or even older versions.

~ ❯❯❯ exiv2 pr ~/Downloads/test3.jpg                                                                                                                                                         ⏎
File name       : /home/[redacted]/Downloads/test3.jpg
File size       : 4544798 Bytes
MIME type       : image/jpeg
Image size      : 5312 x 2988
Camera make     : samsung
Camera model    : SM-N915G
Image timestamp : 2017:05:19 12:45:36
Image number    : 
Exposure time   : 1/246 s
Aperture        : F2.2
Exposure bias   : 0 EV
Flash           : Fired
Flash bias      : 
Focal length    : 4.8 mm (35 mm equivalent: 31.0 mm)
Subject distance: 
ISO speed       : 40
Exposure mode   : Auto
Metering mode   : Multi-segment
Macro mode      : 
Image quality   : 
Exif Resolution : 5312 x 2988
White balance   : Auto
Thumbnail       : image/jpeg, 14701 Bytes
Copyright       : 
Exif comment    : 
JKJK	:\<§¼^ÞjòïüÌÄÿÿ5"@Ëÿÿ»bÒÿÿ£
                                   ÿÿ¿Û1"!"" "!""p"p!"!" " " " " " "!"1"1" "1"!"!" " " "00 " " " " "!"A"!" """"" " " " " " " " "!"1" """""""""" "0 " ""pA""""""""""0 " " " """"""""""" "`3p	0 """""""" " " " "p		0 "!" " " " " " " " " "000""!"1" " " " "0 " " " " """ " "1"Q3 " " " "0 "00000 "001"`3`3af " " "0000A"0A"A"A"`3`3`3`3af " " "A"Q3Q3A"1"Q3Q3`3af`3`3`3`3 "	`ß}l¯ê¬B×{wGðöy4ñRlkkkkkkFAFA|P0pFAFAeÿ/ª ®dåaÿ/qj=¸%ÿ/ý®oÛÙ$ÿ/ېuê$ÿ/9-|Y1"ÿ/"pA"`3`3afafafafqfqfafQ3afafafafSñT
                                                                            ®¾ÿ/ûC/ ÿ/Ût(|5½"ÿ/}Òu*­#ÿ/Q¦Üoì_#ÿ/À1jËa#ÿ/õRjÀ7"ÿ/õRjÀ7"ÿ/õRjÀ7"ÿ/õRFAFA.
                                                                                                                                                      H
                                                                                                                                                       |Z-ìjH
                                                                                                                                                             FZpìè3ÜQyjçpÿFAFA®®®®FýC
                                                                                                                                                                                     JÊ J	[èèò.8¨	8W[Õ2$J
SV]*:^[[?1;2c²9
^[[?1;2cþÿÿÿ (ö]ò¼¥¯
òvsùÿÿÿ|
        4
         J
          7	
                ¡kP02596487H16USHA00VM51FFCFDDF80ssois63AH05 63AH05 63AH05 0 2 3


^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c^[[?1;2c%                                                                                                                      ~ ❯❯❯ 1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c
cd: no such entry in dir stack
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c1
zsh: command not found: 2c

I guess this is mostly gibberish, the payload wasn't crafted for this platform, luckily. But to my eyes this looks like it could be used to successfully perform an exploit.

Building from the github source, I don't see anything anywhere near as scary (just an EXIF comment full of "junk" characters) which makes me wonder whether there was a known fix since 0.25?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.