Skip to content

Commit

Permalink
Compare the item contentType string using strcmp()
Browse files Browse the repository at this point in the history
In avifDecoderFindMetadata(), compare the item contentType string using
strcmp() instead of memcmp(). item->contentType.contentType is a
null-terminated string, so the bytes after the terminating null
character are uninitialized.

BUG=oss-fuzz:66848
  • Loading branch information
wantehchang committed Feb 21, 2024
1 parent da70b01 commit a25db25
Showing 1 changed file with 2 additions and 5 deletions.
7 changes: 2 additions & 5 deletions src/read.c
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,6 @@
// }
static const size_t VISUALSAMPLEENTRY_SIZE = 78;

static const char xmpContentType[] = AVIF_CONTENT_TYPE_XMP;
static const size_t xmpContentTypeSize = sizeof(xmpContentType);

// The only supported ipma box values for both version and flags are [0,1], so there technically
// can't be more than 4 unique tuples right now.
#define MAX_IPMA_VERSION_AND_FLAGS_SEEN 4
Expand Down Expand Up @@ -1677,7 +1674,7 @@ static avifResult avifDecoderFindMetadata(avifDecoder * decoder, avifMeta * meta

AVIF_CHECKRES(avifRWDataSet(&image->exif, avifROStreamCurrent(&exifBoxStream), avifROStreamRemainingBytes(&exifBoxStream)));
} else if (!decoder->ignoreXMP && !memcmp(item->type, "mime", 4) &&
!memcmp(item->contentType.contentType, xmpContentType, xmpContentTypeSize)) {
!strcmp(item->contentType.contentType, AVIF_CONTENT_TYPE_XMP)) {
avifROData xmpContents;
avifResult readResult = avifDecoderItemRead(item, decoder->io, &xmpContents, 0, 0, &decoder->diag);
if (readResult != AVIF_RESULT_OK) {
Expand Down Expand Up @@ -3709,7 +3706,7 @@ static avifResult avifParseCondensedImageBox(avifMeta * meta, uint64_t rawOffset
avifDecoderItem * xmpItem;
AVIF_CHECKRES(avifMetaFindOrCreateItem(meta, /*itemID=*/4, &xmpItem));
memcpy(xmpItem->type, "mime", 4);
memcpy(xmpItem->contentType.contentType, xmpContentType, xmpContentTypeSize);
memcpy(xmpItem->contentType.contentType, AVIF_CONTENT_TYPE_XMP, sizeof(AVIF_CONTENT_TYPE_XMP));
xmpItem->descForID = colorItem->id;
colorItem->premByID = alphaIsPremultiplied;

Expand Down

0 comments on commit a25db25

Please sign in to comment.