#83 Makernote saving leaves uninitialized padding bytes

closed-wont-fix
Jan Patera
libexif (61)
5
2008-06-27
2008-03-11
ikamakj
No

In the for loop of exif_mnote_data_olympus_save(), if the data size 's' is less than 4 bytes, the data is written in the directory entry, but the code leaves the unused 4-s bytes uninitialized.

The same is true of exif_mnote_data_fuji_save(), despite the comment "Fill unneeded bytes with 0".

To correct this, the code should be similar to exif_data_save_data_entry() and exif_mnote_data_canon_save(), which set the padding bytes to zero. Adding the following as the last lines inside the loop should correct this problem in both cases:

if (s < 4)
memset (*buf + doff + s, 0, (4 - s));

Discussion

  • Jan Patera
    Jan Patera
    2008-06-25

    Logged In: YES
    user_id=943941
    Originator: NO

    In what scenario do you get the data uninitialized? I was thinking of removing the memsets
    from other places: the buffer is allocated by exif_mem_alloc which in the default implementation calls calloc(). When I change it to malloc to leave it uninitialized then
    I see problems on many places where it is assumed that exif_mem_alloc initializes the
    memory to zeros...

     
  • ikamakj
    ikamakj
    2008-06-26

    Logged In: YES
    user_id=1816193
    Originator: YES

    Sorry, it seems my analysis of the problem was wrong. I was testing this with an older version, which left two unfilled bytes right after the tag table (not in the tag table itself) in the Nikon v2 case.
    Of course, if you are going to remove memsets, you have to be careful to do this only for memory locations that are guaranteed to be allocated with calloc, not with realloc.

     
  • Jan Patera
    Jan Patera
    2008-06-27

    Logged In: YES
    user_id=943941
    Originator: NO

    So then, I am closing this log as false report.

     
  • Jan Patera
    Jan Patera
    2008-06-27

    • assigned_to: nobody --> patera
    • status: open --> closed-wont-fix