[FFmpeg-devel] [PR] avcodec/exif.c: ignore synthetic tags as IFDs (PR #21352)

[FFmpeg-devel] [PR] avcodec/exif.c: ignore synthetic tags as IFDs (PR #21352)

[ruikai via ffmpeg-devel]

PR #21352 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21352
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21352.patch

Synthetic extra IFD tags (0xFFED..0xFFFC) are reserved and
should not be treated as IFDs when they come from input.
Refuse to parse them as IFDs and only peel entries that are real IFDs,

This fixes a heap OOB when synthetic tags are nested and sized
without the 12 bytes directory slot but survived peeling.


>From 64924fb88b77a962f0cd6c21d4b82cc164c391f4 Mon Sep 17 00:00:00 2001
From: retr0reg <retr0@retr0.blog>
Date: Thu, 1 Jan 2026 16:55:46 -0500
Subject: [PATCH] avcodec/exif.c: ignore synthetic tags as IFDs

Synthetic extra IFD tags (0xFFED..0xFFFC) are reserved and
should not be treated as IFDs when they come from input.
Refuse to parse them as IFDs and only peel entries that are real IFDs,

This fixes a heap OOB when synthetic tags are nested and sized
without the 12 bytes directory slot but survived peeling.
---
 libavcodec/exif.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/libavcodec/exif.c b/libavcodec/exif.c
index 5ce402784c..775fe1a983 100644
--- a/libavcodec/exif.c
+++ b/libavcodec/exif.c
@@ -230,6 +230,11 @@ static const size_t exif_sizes[] = {
     [AV_TIFF_IFD] = 4,
 };
 
+static av_always_inline int exif_is_synthetic_tag(uint16_t id)
+{
+    return id > 0xFFECu && id <= 0xFFFCu;
+}
+
 const char *av_exif_get_tag_name(uint16_t id)
 {
     for (size_t i = 0; i < FF_ARRAY_ELEMS(tag_list); i++) {
@@ -498,7 +503,8 @@ static int exif_decode_tag(void *logctx, GetByteContext *gb, int le,
     if (type > AV_TIFF_IFD || count >= INT_MAX/8U)
         return AVERROR_INVALIDDATA;
 
-    is_ifd = type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG;
+    is_ifd = (type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG) &&
+             !exif_is_synthetic_tag(entry->id);
 
     if (is_ifd) {
         if (!payload)
@@ -805,6 +811,8 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer,
         ret = av_exif_get_entry(logctx, (AVExifMetadata *) ifd, extra_tag, 0, &extra_entry);
         if (ret < 0)
             break;
+        if (extra_entry->type != AV_TIFF_IFD)
+            continue;
         if (!ret)
             continue;
         av_log(logctx, AV_LOG_DEBUG, "found extra IFD tag: %04x\n", extra_tag);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org