Fix stack overflow

[drewnoakes]

Fixes the .NET side of drewnoakes/metadata-extractor#419.

[kwhopper]

It looks like you updated PanasonicRawWbInfo2Descriptor as well. You might do the same thing on the Java side before approving that one.

But on the dotnet side, this all seems reasonable.

[benSlaughter]

👋 Hi @drewnoakes @kwhopper I'm a member of the GitHub software security team.
I'm not sure if you are aware of it but we have had CVE-2019-14262 come to our attention. I saw that this pull request is a fix, but it has not been released yet.
Would you be happy to create a Security Advisory for this and publish it once you have released a fixed version?
Our tooling will pick that advisory up once you publish it and we'll send alerts to your users including the details you write there, along with details of the fixed version.
I've put a one week hold on this on our side in the meantime.

[VPKSoft]

Hi,
I'm sorry to ask you to hurry a fixed release to come available. This is a great library and I haven't had any issues with this stack overflow happening - however if this is noticed by a security analysts as a moderate security flaw, it shouldn't 🙄 take many minutes to create a new NuGet release of the software as the source code seems already to be fixed. I would actually be happy if anyone would report a security flaw within my projects, but not being as popular as this - no one probably will not 🤔.
Thanks again for the great software 👍

[drewnoakes]

Version 2.2.0 is released which includes this fix along with several other improvements.

[VPKSoft]

Thank you - no more security alerts from the GitHub then 😀

[philipjss]

@drewnoakes hello - I am looking for a non-dotnet version of this library that contains the same whitesource vulnerability fix. I see that the dotnet version with the fix is 2.2.0, dated 27 Oct 2019.

Am I right in assuming that non-dotnet versions 2.12.0 (6 Jul 2019) and 2.13.0 (21 Jan 2020) contain the same fix?

Thanks,

Philip

[drewnoakes]

@philipjss I assume you're referring to the Java implementation. For that library, version 2.13.0 contains the stack overflow fix.

https://github.com/drewnoakes/metadata-extractor/releases/tag/2.13.0