From dc6eac6e9655d14d0779d99e82d0f5f442d2f34b Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Thu, 2 Apr 2026 13:26:31 +0200 Subject: [PATCH] fixed 2 unsigned integer underflows this could cause crashes or data leaks. Reported-by: Kerwin --- libexif/fuji/exif-mnote-data-fuji.c | 2 +- libexif/olympus/exif-mnote-data-olympus.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c index c28c541..2dcb877 100644 --- a/libexif/fuji/exif-mnote-data-fuji.c +++ b/libexif/fuji/exif-mnote-data-fuji.c @@ -70,7 +70,7 @@ exif_mnote_data_fuji_get_value (ExifMnoteData *d, unsigned int i, char *val, uns ExifMnoteDataFuji *n = (ExifMnoteDataFuji *) d; if (!d || !val) return NULL; - if (i > n->count -1) return NULL; + if (i >= n->count) return NULL; /* exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji", "Querying value for tag '%s'...", diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c index a57af17..428f365 100644 --- a/libexif/olympus/exif-mnote-data-olympus.c +++ b/libexif/olympus/exif-mnote-data-olympus.c @@ -78,7 +78,7 @@ exif_mnote_data_olympus_get_value (ExifMnoteData *d, unsigned int i, char *val, ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) d; if (!d || !val) return NULL; - if (i > n->count -1) return NULL; + if (i >= n->count) return NULL; /* exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus", "Querying value for tag '%s'...", -- 2.53.0