Integer overflow in Photoshop::setIptcIrb

[kevinbackhouse]

Reported by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45302

There is an integer overflow here:

exiv2/src/jpgimage.cpp

Line 185 in 790fc46

while (0 == Photoshop::locateIptcIrb(pPsData + pos, sizePsData - pos, &record, &sizeHdr, &sizeIptc)) {

The problem is that there is no check that pos <= sizePsData, so the subtraction can overflow. This problem used to be a latent bug, masked by the use of the signed type long, but the recent switch to size_t has made it triggerable. This problem only exists on main. It does not affect any released versions of Exiv2.

poc: poc.tar.gz

To reproduce:

./bin/fuzz-read-print-write clusterfuzz-testcase-minimized-fuzz-read-print-write-4560990975426560

It doesn't actually cause a crash for me. OSS-Fuzz must be using different build settings to catch it. I had to set a breakpoint on Exiv2::Photoshop::setIptcIrb and step through the loop to see the overflow manually.

[piponazo]

• Fix in main [main] Fix integer overflow #2179 #2181
• Fix in 0.27-maintenance