Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exif.Decode() panics on empty Tiff.Dirs #39

Closed
joeshaw opened this issue Jun 23, 2015 · 1 comment
Closed

exif.Decode() panics on empty Tiff.Dirs #39

joeshaw opened this issue Jun 23, 2015 · 1 comment

Comments

@joeshaw
Copy link

joeshaw commented Jun 23, 2015

I've started running https://github.com/dvyukov/go-fuzz against goexif. One panic I've seen is:

panic: runtime error: index out of range

goroutine 1 [running]:
github.com/rwcarlsen/goexif/exif.(*parser).Parse(0x2b3f60, 0x20832e510, 0x0, 0x0)
    /var/folders/69/cstplpp51jz6f9_5m_m__3gh0000gq/T/go-fuzz-build329778221/src/github.com/rwcarlsen/goexif/exif/exif.go:147 +0x77a
github.com/rwcarlsen/goexif/exif.Decode(0x2208307a30, 0x208312080, 0x2b3d58, 0x0, 0x0)
    /var/folders/69/cstplpp51jz6f9_5m_m__3gh0000gq/T/go-fuzz-build329778221/src/github.com/rwcarlsen/goexif/exif/exif.go:287 +0xec4
github.com/joeshaw/goexif-fuzz.Fuzz(0x22084b6000, 0x1a45, 0x200000, 0x1)
    /var/folders/69/cstplpp51jz6f9_5m_m__3gh0000gq/T/go-fuzz-build329778221/src/github.com/joeshaw/goexif-fuzz/fuzz.go:10 +0x133
github.com/dvyukov/go-fuzz/go-fuzz-dep.Main(0x21c378)
    /Users/joeshaw/src/gosrc/src/github.com/dvyukov/go-fuzz/go-fuzz-dep/main.go:44 +0x13d
main.main()
    /var/folders/69/cstplpp51jz6f9_5m_m__3gh0000gq/T/go-fuzz-build329778221/src/go-fuzz-main/main.go:10 +0x2a

This is because x.Tiff.Dirs has length 0. The exact data fed in is:

"II*\x00\x00\x00\x00\x00"

I'm not sure about what the right level to fix this is. I see a few options:

  • Is it valid to generate a tiff.Tiff with len(t.Dirs) == 0? If not, an error should probably be thrown from tiff.Decode().
  • If it is valid, exif.parser.Parse() should check len(x.Tiff.Dirs) before accessing the first element and error out.
@rwcarlsen
Copy link
Owner

Fixed by #49

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants