X-Spam-Check-By: sourceware.org
Date: Mon, 9 Jan 2006 21:04:19 -0500
From: David Arnstein <arnstein AT panix DOT com>
To: cygwin AT cygwin DOT com
Subject: Please rev. libexif to prevent segfault
Message-ID: <20060110020419.GA20284@panix.com>
Reply-To: arnstein AT pobox DOT com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.10i
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

The default version of the libexif package seems to be 0.6.12-1. There
is a fatal error in this version. It has been fixed in 0.6.13

In exif-data.c, there is a single line of code
	if (s & 1) *ds++;

The author really wanted
	if (s & 1) (*ds)++;

This bug will be exercised whenever a certain EXIF record has an odd
number of bytes. At that point, a program crash is all but certain. 


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/