diff -rupN --no-dereference exiv2-0.27.4/src/jp2image.cpp exiv2-0.27.4-new/src/jp2image.cpp
--- exiv2-0.27.4/src/jp2image.cpp 2021-08-11 09:16:27.789198063 +0200
+++ exiv2-0.27.4-new/src/jp2image.cpp 2021-08-11 09:16:27.792198038 +0200
@@ -658,12 +658,14 @@ static void boxes_check(size_t b,size_t
char* p = (char*) boxBuf.pData_;
bool bWroteColor = false ;
- while ( count < length || !bWroteColor ) {
+ while ( count < length && !bWroteColor ) {
enforce(sizeof(Jp2BoxHeader) <= length - count, Exiv2::kerCorruptedMetadata);
Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;
// copy data. pointer could be into a memory mapped file which we will decode!
- Jp2BoxHeader subBox = *pSubBox ;
+ // pSubBox isn't always an aligned pointer, so use memcpy to do the copy.
+ Jp2BoxHeader subBox;
+ memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader));
Jp2BoxHeader newBox = subBox;
if ( count < length ) {
diff -rupN --no-dereference exiv2-0.27.4/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py exiv2-0.27.4-new/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
--- exiv2-0.27.4/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py 2021-06-15 15:57:33.000000000 +0200
+++ exiv2-0.27.4-new/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py 2021-08-11 09:16:27.793198029 +0200
@@ -1,7 +1,7 @@
# -*- coding: utf-8 -*-
-from system_tests import CaseMeta, path
-
+from system_tests import CaseMeta, CopyTmpFiles, path
+@CopyTmpFiles("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2","$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
"""
@@ -10,13 +10,12 @@ class Jp2ImageEncodeJp2HeaderOutOfBounds
"""
url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj"
- filename1 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
- filename2 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
+ filename1 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
+ filename2 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
commands = ["$exiv2 in $filename1"]
stdout = [""]
stderr = [
"""Error: XMP Toolkit error 201: XML parsing failure
Warning: Failed to decode XMP metadata.
-$filename1: Could not write metadata to file: $kerCorruptedMetadata
"""]
- retval = [1]
+ retval = [0]
diff -rupN --no-dereference exiv2-0.27.4/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py exiv2-0.27.4-new/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
--- exiv2-0.27.4/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py 1970-01-01 01:00:00.000000000 +0100
+++ exiv2-0.27.4-new/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py 2021-08-11 09:16:27.793198029 +0200
@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+@CopyTmpFiles("$data_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
+
+class Jp2ImageEncodeJp2HeaderOutOfBoundsRead2(metaclass=CaseMeta):
+ """
+ Regression test for the bug described in:
+ https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v
+ """
+ url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v"
+
+ filename = path("$tmp_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
+ commands = ["$exiv2 rm $filename"]
+ stdout = [""]
+ retval = [0]
+
+ compare_stderr = check_no_ASAN_UBSAN_errors