respect the TIFF offset prefix (#5768)

ImageMagick · Dec 29, 2022 · df099de · df099de
1 parent 555b2cd
commit df099de
Show file tree

Hide file tree

Showing 2 changed files with 49 additions and 28 deletions.
diff --git a/coders/heic.c b/coders/heic.c
@@ -215,11 +215,23 @@ static MagickBooleanType ReadHEICExifProfile(Image *image,
   exif_profile=AcquireStringInfo(length);
   error=heif_image_handle_get_metadata(image_handle,id,
     GetStringInfoDatum(exif_profile));
-  if ((IsHEIFSuccess(image,&error,exception) != MagickFalse) &&
-      (length > 8))
+  if ((IsHEIFSuccess(image,&error,exception) != MagickFalse) && (length > 4))
     {
-      (void) DestroyStringInfo(SplitStringInfo(exif_profile,8));
-      (void) SetImageProfile(image,"exif",exif_profile,exception);
+      /*
+        Extract Exif profile.
+      */
+      StringInfo *snippet = SplitStringInfo(exif_profile,4);
+      unsigned int offset = 0;
+      offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+0)) << 24;
+      offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+1)) << 16;
+      offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+2)) << 8;
+      offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+3)) << 0;
+      snippet=DestroyStringInfo(snippet);
+      if (offset < GetStringInfoLength(exif_profile))
+        {
+          (void) DestroyStringInfo(SplitStringInfo(exif_profile,offset));
+          (void) SetImageProfile(image,"exif",exif_profile,exception);
+        }
     }
   exif_profile=DestroyStringInfo(exif_profile);
   return(MagickTrue);
@@ -845,7 +857,7 @@ static void WriteProfile(struct heif_context *context,Image *image,
     length=GetStringInfoLength(profile);
     if (LocaleCompare(name,"EXIF") == 0)
       {
-        StringInfo *exif_profile = AcquireStringInfo(4);
+        StringInfo *exif_profile = StringToStringInfo("\0\0\0\6Exif\0\0");
         ConcatenateStringInfo(exif_profile,profile);
         length=GetStringInfoLength(exif_profile);
         if (length > 65533L)

diff --git a/coders/jxl.c b/coders/jxl.c
@@ -66,11 +66,6 @@
 #include <jxl/thread_parallel_runner.h>
 #endif
 
-/*
-  Define declarations.
-*/
-#define ExifNamespace  "Exif\0\0"
-
 /*
   Typedef declarations.
 */
@@ -582,10 +577,21 @@ static Image *ReadJXLImage(const ImageInfo *image_info,ExceptionInfo *exception)
             exif_profile=AcquireStringInfo((size_t) size);
             p=GetStringInfoDatum(exif_profile);
             jxl_status=JxlDecoderSetBoxBuffer(jxl_info,p,size);
-            if (size > 8)
+            if (size > 4)
               {
-                (void) DestroyStringInfo(SplitStringInfo(exif_profile,4));
-                SetStringInfoLength(exif_profile,size-8);
+                /*
+                  Extract Exif profile.
+                */
+                StringInfo *snippet = SplitStringInfo(exif_profile,4);
+                unsigned int offset = 0;
+                offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+0)) << 24;
+                offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+1)) << 16;
+                offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+2)) << 8;
+                offset|=(unsigned int) (*(GetStringInfoDatum(snippet)+3)) << 0;
+                snippet=DestroyStringInfo(snippet);
+                if (offset < GetStringInfoLength(exif_profile))
+                  (void) DestroyStringInfo(SplitStringInfo(exif_profile,
+                    offset));
               }
           }
         if (LocaleNCompare(type,"xml ",sizeof(type)) == 0)
@@ -614,17 +620,19 @@ static Image *ReadJXLImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
   }
   (void) JxlDecoderReleaseBoxBuffer(jxl_info);
-  if (exif_profile != (StringInfo *) NULL)
+  if ((exif_profile != (StringInfo *) NULL) &&
+      (GetStringInfoLength(exif_profile) > 6))
     {
       /*
         Cache Exif profile.
       */
-      StringInfo *profile = StringToStringInfo(ExifNamespace);
+      StringInfo *profile = StringToStringInfo("Exif\0\0");
       DestroyStringInfo(SplitStringInfo(exif_profile,2));
       ConcatenateStringInfo(profile,exif_profile);
-      exif_profile=DestroyStringInfo(exif_profile);
+      SetStringInfoLength(profile,GetStringInfoLength(profile)-4);
       (void) SetImageProfile(image,"exif",profile,exception);
       profile=DestroyStringInfo(profile);
+      exif_profile=DestroyStringInfo(exif_profile);
     }
   if (xmp_profile != (StringInfo *) NULL)
     {
@@ -942,27 +950,28 @@ static MagickBooleanType WriteJXLImage(const ImageInfo *image_info,Image *image,
   if ((exif_profile != (StringInfo *) NULL) ||
       (xmp_profile != (StringInfo *) NULL))
     {
-      /*
-        Add metadata boxes.
-      */
       (void) JxlEncoderUseBoxes(jxl_info);
-      if (exif_profile != (StringInfo *) NULL)
+      if ((exif_profile != (StringInfo *) NULL) &&
+          (GetStringInfoLength(exif_profile) > 6))
         {
           /*
-            Prepend a 2-byte header.
+            Add Exif profile.
           */
-          StringInfo *profile = AcquireStringInfo(2);
-          ConcatenateStringInfo(profile,exif_profile);
-          (void) DestroyStringInfo(SplitStringInfo(profile,
-            strlen(ExifNamespace)));
-          (void) memset(GetStringInfoDatum(profile),0,2);
+          StringInfo *profile = CloneStringInfo(exif_profile);
+          DestroyStringInfo(SplitStringInfo(profile,2));
+          SetStringInfoLength(profile,GetStringInfoLength(profile));
           (void) JxlEncoderAddBox(jxl_info,"Exif",GetStringInfoDatum(profile),
             GetStringInfoLength(profile),0);
           profile=DestroyStringInfo(profile);
         }
       if (xmp_profile != (StringInfo *) NULL)
-        (void) JxlEncoderAddBox(jxl_info,"xml ",GetStringInfoDatum(xmp_profile),
-          GetStringInfoLength(xmp_profile),0);
+        {
+          /*
+            Add Exif profile.
+          */
+          (void) JxlEncoderAddBox(jxl_info,"xml ",GetStringInfoDatum(
+            xmp_profile),GetStringInfoLength(xmp_profile),0);
+        }
       (void) JxlEncoderCloseBoxes(jxl_info);
     }
   jxl_status=JXLWriteMetadata(image,jxl_info);