#1117964 exifprobe: Buffer overflow in exifprobe

Package:
exifprobe
Source:
exifprobe
Description:
read metadata from digital pictures
Submitter:
Jaehoon Jang
Date:
2025-10-13 03:35:05 UTC
Severity:
normal
#1117964#5
Date:
2025-10-13 02:33:08 UTC
From:
To:
Dear Maintainer,

During fuzz testing of exifprobe, a buffer overflow was discovered that prevents the program from functioning correctly.

Build options
```
git clone https://salsa.debian.org/pkg-security-team/exifprobe.git
cd exifprobe
CC="clang -fsanitize=address -g" CXX="clang++ -fsanitize=address -g" make
```

ASAN Log

```
==530==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000eca760 at pc 0x00000042f862 bp 0x7ffcf73164d0 sp 0x7ffcf7315c88
READ of size 8193 at 0x000000eca760 thread T0
    #0 0x42f861 in strndup /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:397:3
    #1 0x506c55 in strdup_value /root/exifprobe/misc.c:105:19
    #2 0x4f854a in process_tiff_ifd /root/exifprobe/process.c:419:49
    #3 0x4eb32d in main /root/exifprobe/main.c:203:38
```

The poc file used can be downloaded from the link below.
- https://drive.google.com/file/d/1xKhPSN5S6jcprphvlaWy8wvvp6DIuW4a/view?usp=drive_link

This bug (vulnerability) can lead to a buffer overflow due to the use of the strndup function. Based on a simple analysis, it appears that the issue arises because `entry->count` can take on an excessively large value, which causes the problem.


```
val = strndup(buf, entry->count); //misc.c:105:19
```

Therefore, it seems necessary to guard the value of entry->count in order to prevent potential security vulnerabilities.