exiv2/exiv2-CVE-2025-26623.patch

From facce628f3622764e91a8161f89ade8cb34bc120 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Mon, 17 Feb 2025 16:34:40 -0800
Subject: [PATCH] Revert "fix copy constructors"

This reverts commit afb2d998fe62f7e829e93e62506bf9968117c9c5.

This commit is wrong and ends up resulting in use after frees because of
C pointers. The proper solution is shared_ptr instead of C pointers but
that's a lot more involved than reverting this.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ebff8b48820b96c786cfddbf0bebb395cb1317d7)
---
 src/tiffcomposite_int.cpp | 19 +++++++++++++++++++
 src/tiffcomposite_int.hpp |  6 +++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/src/tiffcomposite_int.cpp b/src/tiffcomposite_int.cpp
index 95ce450c7d..3e6e93d5c5 100644
--- a/src/tiffcomposite_int.cpp
+++ b/src/tiffcomposite_int.cpp
@@ -127,6 +127,25 @@ TiffEntryBase::TiffEntryBase(const TiffEntryBase& rhs) :
     storage_(rhs.storage_) {
 }
 
+TiffDirectory::TiffDirectory(const TiffDirectory& rhs) : TiffComponent(rhs), hasNext_(rhs.hasNext_) {
+}
+
+TiffSubIfd::TiffSubIfd(const TiffSubIfd& rhs) : TiffEntryBase(rhs), newGroup_(rhs.newGroup_) {
+}
+
+TiffBinaryArray::TiffBinaryArray(const TiffBinaryArray& rhs) :
+    TiffEntryBase(rhs),
+    cfgSelFct_(rhs.cfgSelFct_),
+    arraySet_(rhs.arraySet_),
+    arrayCfg_(rhs.arrayCfg_),
+    arrayDef_(rhs.arrayDef_),
+    defSize_(rhs.defSize_),
+    setSize_(rhs.setSize_),
+    origData_(rhs.origData_),
+    origSize_(rhs.origSize_),
+    pRoot_(rhs.pRoot_) {
+}
+
 TiffComponent::UniquePtr TiffComponent::clone() const {
   return UniquePtr(doClone());
 }
diff --git a/src/tiffcomposite_int.hpp b/src/tiffcomposite_int.hpp
index 4506a4dca0..307e0bd9e3 100644
--- a/src/tiffcomposite_int.hpp
+++ b/src/tiffcomposite_int.hpp
@@ -851,7 +851,7 @@ class TiffDirectory : public TiffComponent {
   //! @name Protected Creators
   //@{
   //! Copy constructor (used to implement clone()).
-  TiffDirectory(const TiffDirectory&) = default;
+  TiffDirectory(const TiffDirectory& rhs);
   //@}
 
   //! @name Protected Manipulators
@@ -944,7 +944,7 @@ class TiffSubIfd : public TiffEntryBase {
   //! @name Protected Creators
   //@{
   //! Copy constructor (used to implement clone()).
-  TiffSubIfd(const TiffSubIfd&) = default;
+  TiffSubIfd(const TiffSubIfd& rhs);
   TiffSubIfd& operator=(const TiffSubIfd&) = delete;
   //@}
 
@@ -1346,7 +1346,7 @@ class TiffBinaryArray : public TiffEntryBase {
   //! @name Protected Creators
   //@{
   //! Copy constructor (used to implement clone()).
-  TiffBinaryArray(const TiffBinaryArray&) = default;
+  TiffBinaryArray(const TiffBinaryArray& rhs);
   //@}
 
   //! @name Protected Manipulators