Cyclic directory references in EXIF data cause StackOverflowErrors

[jabshire]

When you give TwelveMonkeys a JPEG with an EXIF directory that points to itself, you get a StackOverflowError:

    at com.twelvemonkeys.imageio.metadata.exif.EXIFReader.readValue(EXIFReader.java:344) ~[TwelveMonkeys-imageio-metadata-3.3.2.jar:?]
    at com.twelvemonkeys.imageio.metadata.exif.EXIFReader.readValueAt(EXIFReader.java:287) ~[TwelveMonkeys-imageio-metadata-3.3.2.jar:?]
    at com.twelvemonkeys.imageio.metadata.exif.EXIFReader.readEntry(EXIFReader.java:277) ~[TwelveMonkeys-imageio-metadata-3.3.2.jar:?]
    at com.twelvemonkeys.imageio.metadata.exif.EXIFReader.readDirectory(EXIFReader.java:109) ~[TwelveMonkeys-imageio-metadata-3.3.2.jar:?]
    at com.twelvemonkeys.imageio.metadata.exif.EXIFReader.readDirectory(EXIFReader.java:133) ~[TwelveMonkeys-imageio-metadata-3.3.2.jar:?]  (this one repeats until you StackOverflow)

This is line 133:
CompoundDirectory next = (CompoundDirectory) readDirectory(pInput, nextOffset, true);

You can see where another library solved this same issue: https://github.com/drewnoakes/metadata-extractor/blob/master/Source/com/drew/imaging/tiff/TiffReader.java#L112-L118

This is on 3.3.2, which is an old version. But if I upgrade locally to the latest version, it just hangs instead of stack overflowing.

[haraldk]

Hi Jeff,

Thanks for reporting!

I just made some change to the TIFF parsing that might help in this case (we no longer parse arbitrary nested IFDs), but I think the case may still happen for TIFF SubIFDs. This fix is currently only in my local branch, not in master or in the released 3.4.1. Hope to push it soon. Possibly related: #469

Do you happen to have a TIFF structure (or a JPEG containing an Exif segment) that has this problem, it would be very helpful if you could attach the file to the issue.

Best regards,

--
Harald K

[jabshire]

My guess for where it's infinite looping in the new version is https://github.com/haraldk/TwelveMonkeys/blob/master/imageio/imageio-metadata/src/main/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReader.java#L117-L128

Sample photo which breaks: http://www.danalog.org/images/exif-loop.jpg

[haraldk]

Thanks!

I realized the fixed version is only local, so it isn't in the master branch yet, sorry...

But I'll look into it!

--
Harald K

[haraldk]

Finally had some time to look at this.

Fixed.