From 22ea582c6b74ada30bec3a6b15de3c3e52f2b4da Mon Sep 17 00:00:00 2001
From: Robin Mills <robin@clanmills.com>
Date: Mon, 5 Apr 2021 20:33:25 +0100
Subject: [PATCH 1/2] fix_1522_jp2image_exif_asan

---
 src/jp2image.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index eb31cea4a5..88ab9b2d61 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -28,6 +28,7 @@
 #include "image.hpp"
 #include "image_int.hpp"
 #include "basicio.hpp"
+#include "enforce.hpp"
 #include "error.hpp"
 #include "futils.hpp"
 #include "types.hpp"
@@ -353,7 +354,7 @@ static void boxes_check(size_t b,size_t m)
                             if (io_->error()) throw Error(kerFailedToReadImageData);
                             if (bufRead != rawData.size_) throw Error(kerInputDataReadFailed);
 
-                            if (rawData.size_ > 0)
+                            if (rawData.size_ > 8) // "II*\0long"
                             {
                                 // Find the position of Exif header in bytes array.
                                 long pos = (     (rawData.pData_[0]      == rawData.pData_[1])
@@ -497,6 +498,7 @@ static void boxes_check(size_t b,size_t m)
                 position   = io_->tell();
                 box.length = getLong((byte*)&box.length, bigEndian);
                 box.type = getLong((byte*)&box.type, bigEndian);
+                enforce(box.length <= io_->size()-io_->tell() , Exiv2::kerCorruptedMetadata);
 
                 if (bPrint) {
                     out << Internal::stringFormat("%8ld | %8ld | ", (size_t)(position - sizeof(box)),
@@ -581,12 +583,13 @@ static void boxes_check(size_t b,size_t m)
                                 throw Error(kerInputDataReadFailed);
 
                             if (bPrint) {
-                                out << Internal::binaryToString(makeSlice(rawData, 0, 40));
+                                out << Internal::binaryToString(
+                                        makeSlice(rawData, 0, rawData.size_>40?40:rawData.size_));
                                 out.flush();
                             }
                             lf(out, bLF);
 
-                            if (bIsExif && bRecursive && rawData.size_ > 0) {
+                            if (bIsExif && bRecursive && rawData.size_ > 8) { // "II*\0long"
                                 if ((rawData.pData_[0] == rawData.pData_[1]) &&
                                     (rawData.pData_[0] == 'I' || rawData.pData_[0] == 'M')) {
                                     BasicIo::AutoPtr p = BasicIo::AutoPtr(new MemIo(rawData.pData_, rawData.size_));

From cac151ec052d44da3dc779e9e4028e581acb128a Mon Sep 17 00:00:00 2001
From: Robin Mills <robin@clanmills.com>
Date: Mon, 5 Apr 2021 20:33:38 +0100
Subject: [PATCH 2/2] test fix_1522_jp2image_exif_asan

---
 test/data/poc_1522.jp2                   | Bin 0 -> 268 bytes
 tests/bugfixes/github/test_issue_1522.py |  25 +++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 test/data/poc_1522.jp2
 create mode 100644 tests/bugfixes/github/test_issue_1522.py

diff --git a/test/data/poc_1522.jp2 b/test/data/poc_1522.jp2
new file mode 100644
index 0000000000000000000000000000000000000000..d2a3f12152a047adc47fcbaaad904b102c30fe87
GIT binary patch
literal 268
zcmZQzVBpCLP*C9IYUg5LV2~^=%}ntsNDs+OOLMKrOw+aV3NYGNb^i49l}<0_6waJ7
z@$vdKMhZZcx>*HA89-VrGb5$Q*Ox&H$Yx_;07~5ta@F;73}9ejf`Nui0XeV#|9?OJ
z3Kl_d8AKRBh=J+b|GNva#bZ+#Q@%4YGcbdN7#Mtg|9@%#Yk2@Ois8Sn0>~<mB*f0x
z|FsMZyuZXGy%;!w!i?V-7^Hx7Y=B#;LJO}L*jo+v6&Mm37zAE@XYeg%(qeFz<X~X=
U|6jnx($_aw;QLdcog54d05JnbC;$Ke

literal 0
HcmV?d00001

diff --git a/tests/bugfixes/github/test_issue_1522.py b/tests/bugfixes/github/test_issue_1522.py
new file mode 100644
index 0000000000..e5831b2516
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_1522.py
@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+class issue_1522_exif_asan(metaclass=system_tests.CaseMeta):
+    url      = "https://github.com/Exiv2/exiv2/issues/1522"
+    filename = "$data_path/poc_1522.jp2"
+    commands = ["$exiv2     $filename"
+               ,"$exiv2 -pS $filename"
+               ]
+    retval   = [ 253,1 ] 
+    stderr   = [ """Warning: Failed to decode Exif metadata.
+$filename: No Exif data found in the file
+""","""$exiv2_exception_message $filename:
+$kerCorruptedMetadata
+"""] 
+    stdout   = ["""File name       : $filename
+File size       : 268 Bytes
+MIME type       : image/jp2
+Image size      : 0 x 0
+""","""STRUCTURE OF JPEG2000 FILE: $filename
+ address |   length | box       | data
+       0 |       12 | jP        | 
+      12 |       25 | uuid      | Exif: .
+"""
+]