Merge pull request #1925 from kevinbackhouse/my_fix_01

fix out of range access, minor performance improvement (0.27-maintenance backport)
Exiv2 · Sep 29, 2021 · a8bd3a6 · a8bd3a6
2 parents a6fa92d + d853f14
commit a8bd3a6
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 2 deletions.
diff --git a/src/tags_int.cpp b/src/tags_int.cpp
@@ -3227,8 +3227,8 @@ namespace Exiv2 {
         }
 
         std::string stringValue = value.toString();
-        if (stringValue.at(19) == 'Z') {
-            stringValue = stringValue.substr(0, 19);
+        if (stringValue.size() == 20 && stringValue.at(19) == 'Z') {
+            stringValue.erase(19,1);
         }
         for (size_t i = 0; i < stringValue.length(); ++i) {
             if (stringValue[i] == 'T') stringValue[i] = ' ';

diff --git a/test/data/issue_1918_poc1.jpg b/test/data/issue_1918_poc1.jpg
diff --git a/test/data/issue_1918_poc2.jpg b/test/data/issue_1918_poc2.jpg
diff --git a/test/data/issue_1918_poc3.jpg b/test/data/issue_1918_poc3.jpg
diff --git a/tests/bugfixes/github/test_issue_1918.py b/tests/bugfixes/github/test_issue_1918.py
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, path, check_no_ASAN_UBSAN_errors
+
+class PrintXmpDateOutOfBoundsIndex19(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1918
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1918"
+
+    filename1 = path("$data_path/issue_1918_poc1.jpg")
+    filename2 = path("$data_path/issue_1918_poc2.jpg")
+    filename3 = path("$data_path/issue_1918_poc3.jpg")
+    commands = ["$exiv2 -px $filename1", "$exiv2 -px $filename2", "$exiv2 -px $filename3"]
+    stderr = ["", "", ""]
+    retval = [0, 0, 0]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors