exiv2/CVE-2025-26623.patch
wk333 3d62e894e3 Fix CVE-2025-26623
(cherry picked from commit 1b97e609a53f6ea3828d361323c64b99a77bfff3)
2025-02-24 10:33:38 +08:00

81 lines
2.7 KiB
Diff

From ebff8b48820b96c786cfddbf0bebb395cb1317d7 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Mon, 17 Feb 2025 16:34:40 -0800
Subject: [PATCH] Revert "fix copy constructors"
Origin: https://github.com/Exiv2/exiv2/commit/ebff8b48820b96c786cfddbf0bebb395cb1317d7
This reverts commit afb2d998fe62f7e829e93e62506bf9968117c9c5.
This commit is wrong and ends up resulting in use after frees because of
C pointers. The proper solution is shared_ptr instead of C pointers but
that's a lot more involved than reverting this.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
src/tiffcomposite_int.cpp | 19 +++++++++++++++++++
src/tiffcomposite_int.hpp | 6 +++---
2 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/src/tiffcomposite_int.cpp b/src/tiffcomposite_int.cpp
index 07c9a6c843..f4bb5037bd 100644
--- a/src/tiffcomposite_int.cpp
+++ b/src/tiffcomposite_int.cpp
@@ -124,6 +124,25 @@ TiffEntryBase::TiffEntryBase(const TiffEntryBase& rhs) :
storage_(rhs.storage_) {
}
+TiffDirectory::TiffDirectory(const TiffDirectory& rhs) : TiffComponent(rhs), hasNext_(rhs.hasNext_) {
+}
+
+TiffSubIfd::TiffSubIfd(const TiffSubIfd& rhs) : TiffEntryBase(rhs), newGroup_(rhs.newGroup_) {
+}
+
+TiffBinaryArray::TiffBinaryArray(const TiffBinaryArray& rhs) :
+ TiffEntryBase(rhs),
+ cfgSelFct_(rhs.cfgSelFct_),
+ arraySet_(rhs.arraySet_),
+ arrayCfg_(rhs.arrayCfg_),
+ arrayDef_(rhs.arrayDef_),
+ defSize_(rhs.defSize_),
+ setSize_(rhs.setSize_),
+ origData_(rhs.origData_),
+ origSize_(rhs.origSize_),
+ pRoot_(rhs.pRoot_) {
+}
+
TiffComponent::UniquePtr TiffComponent::clone() const {
return UniquePtr(doClone());
}
diff --git a/src/tiffcomposite_int.hpp b/src/tiffcomposite_int.hpp
index 0e28aba912..01d5109a59 100644
--- a/src/tiffcomposite_int.hpp
+++ b/src/tiffcomposite_int.hpp
@@ -851,7 +851,7 @@ class TiffDirectory : public TiffComponent {
//! @name Protected Creators
//@{
//! Copy constructor (used to implement clone()).
- TiffDirectory(const TiffDirectory&) = default;
+ TiffDirectory(const TiffDirectory& rhs);
//@}
//! @name Protected Manipulators
@@ -944,7 +944,7 @@ class TiffSubIfd : public TiffEntryBase {
//! @name Protected Creators
//@{
//! Copy constructor (used to implement clone()).
- TiffSubIfd(const TiffSubIfd&) = default;
+ TiffSubIfd(const TiffSubIfd& rhs);
TiffSubIfd& operator=(const TiffSubIfd&) = delete;
//@}
@@ -1334,7 +1334,7 @@ class TiffBinaryArray : public TiffEntryBase {
//! @name Protected Creators
//@{
//! Copy constructor (used to implement clone()).
- TiffBinaryArray(const TiffBinaryArray&) = default;
+ TiffBinaryArray(const TiffBinaryArray& rhs);
//@}
//! @name Protected Manipulators