--- libexif-0.6.12/libexif/exif-data.c.recurse 2005-05-06 13:35:17.610294000 -0400 +++ libexif-0.6.12/libexif/exif-data.c 2005-05-06 13:37:35.112654000 -0400 @@ -284,9 +284,10 @@ } static void -exif_data_load_data_content (ExifData *data, ExifContent *ifd, - const unsigned char *d, - unsigned int ds, unsigned int offset) +exif_data_load_data_content_recurse (ExifData *data, ExifContent *ifd, + const unsigned char *d, + unsigned int ds, unsigned int offset, + unsigned int level) { ExifLong o, thumbnail_offset = 0, thumbnail_length = 0; ExifShort n; @@ -296,6 +297,13 @@ if (!data || !data->priv) return; + if (level > 150) + { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", + "Deep recursion in exif_data_load_data_content"); + return 0; + } + /* Read the number of entries */ if (offset >= ds - 1) return; n = exif_get_short (d + offset, data->priv->order); @@ -320,18 +328,18 @@ switch (tag) { case EXIF_TAG_EXIF_IFD_POINTER: CHECK_REC (EXIF_IFD_EXIF); - exif_data_load_data_content (data, - data->ifd[EXIF_IFD_EXIF], d, ds, o); + exif_data_load_data_content_recurse (data, + data->ifd[EXIF_IFD_EXIF], d, ds, o, level + 1); break; case EXIF_TAG_GPS_INFO_IFD_POINTER: CHECK_REC (EXIF_IFD_GPS); - exif_data_load_data_content (data, - data->ifd[EXIF_IFD_GPS], d, ds, o); + exif_data_load_data_content_recurse (data, + data->ifd[EXIF_IFD_GPS], d, ds, o, level + 1); break; case EXIF_TAG_INTEROPERABILITY_IFD_POINTER: CHECK_REC (EXIF_IFD_INTEROPERABILITY); - exif_data_load_data_content (data, - data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds, o); + exif_data_load_data_content_recurse (data, + data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds, o, level + 1); break; case EXIF_TAG_JPEG_INTERCHANGE_FORMAT: thumbnail_offset = o; @@ -373,6 +381,14 @@ } static void +exif_data_load_data_content (ExifData *data, ExifContent *ifd, + const unsigned char *d, + unsigned int ds, unsigned int offset) +{ + exif_data_load_data_content_recurse (data, ifd, d, ds, offset, 0); +} + +static void exif_data_save_data_content (ExifData *data, ExifContent *ifd, unsigned char **d, unsigned int *ds, unsigned int offset)