On Tue, Aug 19, 2025 at 06:33:03PM +0300, [email protected] wrote: > The branch, master has been updated > via 4c3f94f2651ce4d6834fbef10e5c287f25720ac9 (commit) > via fe496b0308f1911138698b92bbafac582fa455d7 (commit) > via 535a07d14e16eb2930d2b1e16605eafa95959139 (commit) > via 8132ee046d1a03c5913759c50fce7beda8d3d627 (commit) > via 5d4f873ff31f86f9ae1927f37ca0fcb78da70512 (commit) > via 1e816ebefee0ef479fa76bd2a1fb9ec5d5e807df (commit) > via 93a8091015978c44462626409af71789080bbef4 (commit) > via 303f60684f25ce63951480ef0f759acf41aac938 (commit) > via 5caaadee7954f2014d9e0a17d1edfb961893bcf1 (commit) > via d3190a64c366a79091fe47fddf93c09a7d988802 (commit) <-------- we > are here > via 44af3829796427b89c4b76b56652cc5932ada616 (commit) > via f5ad1c910c168d05cb01315773ab0bd094c9372f (commit) > via e3aa1154aab2656c91ce61915f79516d9b563b61 (commit) > via c6cc2115f45ac26ae42442f8796996eb410f4028 (commit) > via 52dba25661305e3c4a6209d46aea43cd327c960e (commit) > via bfb17d26306592c85cf0c4e909099c621177b062 (commit) > via ba2ea285e0f270a0a885b414cafaace6a89b9a91 (commit) > via ad77345a5d14862f4701e5ad422b03b14934a5b9 (commit) > via bb90b262d6d23f1bca3587a48abc15b951cbbf05 (commit) > via a99fff4e2d4058c57599ba0b968862af82bdad5b (commit) > from a6b5a382dd7ecdd27c5d0ebba688e1db409d18fd (commit) >
> commit d3190a64c366a79091fe47fddf93c09a7d988802 > Author: Leo Izen <[email protected]> > AuthorDate: Tue Mar 25 12:14:32 2025 -0400 > Commit: Leo Izen <[email protected]> > CommitDate: Tue Aug 19 11:26:47 2025 -0400 > > avcodec/pngenc: support writing EXIF profiles > > Add support to write EXIF profiles using the new EXIF framework, namely > ff_exif_get_buffer, and writing them into eXIf chunks. > > Signed-off-by: Leo Izen <[email protected]> > > diff --git a/libavcodec/exif.c b/libavcodec/exif.c > index c48eb5daa6..fa46202874 100644 > --- a/libavcodec/exif.c > +++ b/libavcodec/exif.c > @@ -1350,6 +1350,13 @@ int ff_exif_get_buffer(void *logctx, const AVFrame > *frame, AVBufferRef **buffer_ > } > if (!pw && w && w < 0xFFFFu || !ph && h && h < 0xFFFFu) { > rewrite = 1; > + exif = NULL; > + for (size_t i = 0; i < ifd.count; i++) { > + if (ifd.entries[i].id == EXIFIFD_TAG && ifd.entries[i].type == > AV_TIFF_IFD) { > + exif = &ifd.entries[i].value.ifd; > + break; > + } > + } > if (!exif) { > AVExifMetadata exif_new = { 0 }; > ret = av_exif_set_entry(logctx, &ifd, EXIFIFD_TAG, AV_TIFF_IFD, > 1, NULL, 0, &exif_new); > diff --git a/libavcodec/pngenc.c b/libavcodec/pngenc.c > index 9bbb8267cf..635c89e87e 100644 > --- a/libavcodec/pngenc.c > +++ b/libavcodec/pngenc.c > @@ -22,6 +22,7 @@ > #include "avcodec.h" > #include "codec_internal.h" > #include "encode.h" > +#include "exif_internal.h" > #include "bytestream.h" > #include "lossless_videoencdsp.h" > #include "png.h" > @@ -29,6 +30,7 @@ > #include "zlib_wrapper.h" > > #include "libavutil/avassert.h" > +#include "libavutil/buffer.h" > #include "libavutil/crc.h" > #include "libavutil/csp.h" > #include "libavutil/libm.h" > @@ -373,6 +375,7 @@ static int encode_headers(AVCodecContext *avctx, const > AVFrame *pict) > { > AVFrameSideData *side_data; > PNGEncContext *s = avctx->priv_data; > + AVBufferRef *exif_data = NULL; > int ret; > > /* write png header */ > @@ -414,6 +417,19 @@ static int encode_headers(AVCodecContext *avctx, const > AVFrame *pict) > } > } > > + ret = ff_exif_get_buffer(avctx, pict, &exif_data, AV_EXIF_TIFF_HEADER); > + if (exif_data) { > + // png_write_chunk accepts an int, not a size_t, so we have to check > overflow > + if (exif_data->size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) > + // that's a very big exif chunk, probably a bug > + av_log(avctx, AV_LOG_ERROR, "extremely large EXIF buffer > detected, not writing\n"); > + else > + png_write_chunk(&s->bytestream, MKTAG('e','X','I','f'), > exif_data->data, exif_data->size); > + av_buffer_unref(&exif_data); > + } else if (ret < 0) { > + av_log(avctx, AV_LOG_WARNING, "unable to attach EXIF metadata: > %s\n", av_err2str(ret)); > + } > + > side_data = av_frame_get_side_data(pict, AV_FRAME_DATA_ICC_PROFILE); > if ((ret = png_write_iccp(s, side_data))) > return ret; missing adjustment of max_packet_size, which makes this probably on out of array write of attacker controlled data [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Some Animals are More Equal Than Others. - George Orwell's book Animal Farm
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
