#167 FreeImage 3.18.0 Canon MakerNote out-of-bounds read

[Anonymous]

FreeImage version:
3.18.0

Impact:
A crafted JPEG containing malformed EXIF Canon MakerNote metadata can cause an out-of-bounds read in FreeImage while Canon MakerNote tags are parsed and expanded. This can terminate the parsing process and has caused denial of service in downstream applications.

The affected EXIF directory parser is also used for EXIF metadata embedded in WebP files, so the issue is not limited to JPEG containers.

Root cause:
FreeImage did not verify that a declared TIFF IFD was fully contained within the remaining metadata buffer before iterating over its entries.

An affected MakerNote declared 36 directory entries but contained only 35. FreeImage interpreted bytes following the directory as a 36th entry.

That synthetic entry had TIFF field type zero. The previous validation used:

(tag_type - 1) >= EXIF_NUM_FORMATS

Because tag_type is zero, tag_type - 1 evaluates to -1 after integer promotion, so the invalid type incorrectly passes the upper-bound check.

The invalid entry subsequently reaches Canon MakerNote-specific handling that assumes a typed value is present, resulting in an invalid read.

Fix:
Before iterating over an IFD, verify that the complete structure fits within the remaining metadata buffer:

2 + entry_count * 12 + 4

where:

2  = IFD entry-count field
12 = size of each TIFF directory entry
4  = next-IFD offset field

Also reject TIFF field type zero explicitly and require the type to be within the supported TIFF field-type range.

Reproduction:
Attached regression source generates a synthetic 1x1 JPEG and WebP containing the malformed layout.