cutec-chris / dexif

Lazarus port of Delphi EXIF Library to extract Exif Information from Images
Other
21 stars 18 forks source link

Possible indefinite loop in dMetadata #9

Open Mikkao opened 5 years ago

Mikkao commented 5 years ago

With data from a corrupted JPEG file an indefinite loop in dMetadata can occur. The affected loop starts in line 794 and relies on SectionCnt being increased in line 799 to a maximum of 20, but doesn't take into account that SectionCnt can be (and will be) decreased in line 887, thus remaining at a value of 1 indefinitely and never meeting the break criteria of a SectionCnt of 20. The While condition must not only check the value of SectionCnt, but also make sure that AStream.Position < AStream.Size.

Also, in line 862 an EXIFobj will be created and persist, even if ProcessEXIF in line 865 will not detect any valid data and therefore produce an error string. But the existence of that very EXIFobj will make HasMetaData() in line 890 return a True result although no MetaData is present.

bld08867