PR #21366 opened by Leo Izen (Traneptora) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21366 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21366.patch
If extra IFDs occur outside of the top level, we don't allocate enough buffer space for them. This commit changes our calculation to include their size always, and then we shrink the allocated buffer once every IFD is written (by at most 192 bytes). Signed-off-by: Leo Izen <[email protected]> >From 72f9a790f9e77dc54a86d6f5d519d03e83b6661d Mon Sep 17 00:00:00 2001 From: Leo Izen <[email protected]> Date: Sat, 3 Jan 2026 11:31:21 -0500 Subject: [PATCH] avcodec/exif: avoid overflow with supplemental extra IFDs If extra IFDs occur outside of the top level, we don't allocate enough buffer space for them. This commit changes our calculation to include their size always, and then we shrink the allocated buffer once every IFD is written (by at most 192 bytes). Signed-off-by: Leo Izen <[email protected]> --- libavcodec/exif.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 5ce402784c..01ffa88194 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -673,9 +673,7 @@ static size_t exif_get_ifd_size(const AVExifMetadata *ifd) for (size_t i = 0; i < ifd->count; i++) { const AVExifEntry *entry = &ifd->entries[i]; if (entry->type == AV_TIFF_IFD) { - /* this is an extra IFD, not an entry, so we don't need to add base tag size */ - size_t base_size = entry->id > 0xFFECu && entry->id <= 0xFFFCu ? 0 : BASE_TAG_SIZE; - total_size += base_size + exif_get_ifd_size(&entry->value.ifd) + entry->ifd_offset; + total_size += BASE_TAG_SIZE + exif_get_ifd_size(&entry->value.ifd) + entry->ifd_offset; } else { size_t payload_size = entry->count * exif_sizes[entry->type]; total_size += BASE_TAG_SIZE + (payload_size > 4 ? payload_size : 0); @@ -776,11 +774,10 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, headsize = 0; break; } - buf = av_buffer_alloc(size + off + headsize); - if (!buf) { - ret = AVERROR(ENOMEM); + + ret = av_buffer_realloc(&buf, size + off + headsize); + if (ret < 0) goto end; - } if (header_mode == AV_EXIF_EXIF00) { AV_WL32(buf->data, MKTAG('E','x','i','f')); @@ -853,6 +850,12 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, next += ret; } + /* shrink the buffer to the amount of data we actually used */ + /* extras don't contribute the initial BASE_TAG_SIZE each */ + ret = av_buffer_realloc(&buf, buf->size - BASE_TAG_SIZE * extras); + if (ret < 0) + goto end; + *buffer = buf; ret = 0; -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
