X-Spam-Check-By:	sourceware.org
Date:	Mon, 9 Jan 2006 21:04:19 -0500
From:	David Arnstein <arnstein AT panix DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Please rev. libexif to prevent segfault
Message-ID:	<20060110020419.GA20284@panix.com>
Reply-To:	arnstein AT pobox DOT com
Mime-Version:	1.0
User-Agent:	Mutt/1.5.10i
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

The default version of the libexif package seems to be 0.6.12-1. There
is a fatal error in this version. It has been fixed in 0.6.13

In exif-data.c, there is a single line of code
	if (s & 1) *ds++;

The author really wanted
	if (s & 1) (*ds)++;

This bug will be exercised whenever a certain EXIF record has an odd
number of bytes. At that point, a program crash is all but certain. 


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -