Fix out of buffer access in #1529

[pydera]

No description provided.

[lgtm-com]

This pull request fixes 1 alert when merging 13e5a3e into 05ec053 - view on LGTM.com

fixed alerts:

• 1 for FIXME comment

[clanmills]

I think we should deal with box.length == 1 separately as we might fix that. I'll have a dig about in my test files to see if we have a suitable file.

The change for box.length < 8 is correct. None of the existing error codes is perfect for this error, so throwing Exiv2::kerCorruptedMetadata seems fine to me. You can get a list of the 62 error codes:

593 rmills@rmillsm1:~/gnu/github/exiv2/0.27-maintenance/src $ grep ker error.cpp | wc
      62     124    2528
594 rmills@rmillsm1:~/gnu/github/exiv2/0.27-maintenance/src $ grep ker error.cpp 
        { Exiv2::kerGeneralError,
        { Exiv2::kerSuccess,
        { Exiv2::kerErrorMessage,
        { Exiv2::kerCallFailed,
        { Exiv2::kerNotAnImage,
        { Exiv2::kerInvalidDataset,
        { Exiv2::kerInvalidRecord,
...

[pydera]

I created an issue to deal with this special case to not dilute the CVE: #1537

[clanmills]

Yes. That's very good.

Kevin has powered up on #1530 and submitted a PR for that. I'm going to accept Kevin's.

This is incredible. In 13 years of working on Exiv2, it's the first time that two contributors have submitted PRs for the same issue. I'm amazed that Team Exiv2 is becoming real and solid. Thank You for contributing.