Merge pull request Exiv2#1767 from kevinbackhouse/fix-issue-1763

Fix null iterator deref in printCsLensTypeByMetadata
kevinbackhouse · Jul 9, 2021 · 9284b58 · 9284b58
2 parents c7757d7 + 033175e
commit 9284b58
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 0 deletions.
diff --git a/src/canonmn_int.cpp b/src/canonmn_int.cpp
@@ -2750,6 +2750,7 @@ namespace Exiv2 {
         if (pos == metadata->end() || pos->value().count() < 3 || pos->value().typeId() != unsignedShort ||
             pos->value().toFloat(2) == 0.0F) {
             os << "Unknown Lens (" << lensType << ")";
+            return os;
         }
 
         int const exifFlMin = static_cast<int>(static_cast<float>(pos->value().toLong(1)) / pos->value().toFloat(2));
@@ -2759,6 +2760,7 @@ namespace Exiv2 {
         pos = metadata->findKey(aperKey);
         if (pos == metadata->end() || pos->value().count() != 1 || pos->value().typeId() != unsignedShort) {
             os << "Unknown Lens (" << lensType << ")";
+            return os;
         }
 
         auto exifAperMax = fnumber(canonEv(static_cast<int16_t>(pos->value().toLong(0))));

diff --git a/test/data/issue_1763_poc.exv b/test/data/issue_1763_poc.exv
diff --git a/tests/bugfixes/github/test_issue_1763.py b/tests/bugfixes/github/test_issue_1763.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, path
+
+class CanonPrintCsLensTypeByMetadataNullIteratorDeref(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1763
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1763"
+
+    filename = path("$data_path/issue_1763_poc.exv")
+    commands = ["$exiv2 -Pt $filename"]
+
+    stderr = [""]
+    retval = [0]
+
+    def compare_stdout(self, i, command, got_stdout, expected_stdout):
+        # Check that it printed "Bad value" for the date.
+        self.assertIn("Unknown Lens (254)", got_stdout)