#179 CVE-2021-33367: bound Exif 0th-IFD next-offset read

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.18.0).

CVE-2021-33367 — buffer over-read in jpeg_read_exif_dir() when the 0th IFD claims a next-IFD pointer past the profile. ReadUint32() was called on DIR_ENTRY_ADDR(ifd0th, entriesCount0th) without checking that those 4 bytes sit inside dwLength.

This patch refuses the thumbnail walk when the next-offset field itself is out of range.

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-33367
Report: https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/

GitHub: https://github.com/danoli3/FreeImage/commit/5e1e391

Apply from the FreeImage tree root:

patch -p0 < CVE-2021-33367.patch

Independent of the later Exif MakerNote/signature patches; apply this first if you take both.