exiv2: Fix use-after-free and double-free with exiv2 0.28.x
authorĐoàn Trần Công Danh <congdanhqx@gmail.com>
Mon, 4 Dec 2023 11:51:57 +0000 (18:51 +0700)
committerColin Clark <colin.clark@cclark.uk>
Sun, 10 Dec 2023 13:36:55 +0000 (13:36 +0000)
commit133147d44cb42c2cb694981ab49cfd1bf015c77d
treeff54614a6e8bf63606a0d1de100ac292ebc0da0c
parent022e9b12e84460cc56a140ffbbd12e3bd1027ade
exiv2: Fix use-after-free and double-free with exiv2 0.28.x

In exiv2 0.28.x, DataBuf is only a wrapper for std::vector.
Exiv2::DataBuf::data() returns a shallow copy of its underlying
data.  On Exiv2::DataBuf::reset(), all of its data is invalidated,
includes the data returned by Exiv2::DataBuf::data(). Thus, all usages
of said data is use-after-free, attempt to use its later is double-free.

Make a copy ourselves instead.  This method works for the old exiv2, too.
Since Exiv2::PreviewImage::size() is available from forever, and both
Exiv2::PreviewImage::copy() and Exiv2::PreviewImage::pData() are
introduced in a same change (commit 9578e8123 in 2008).

Fixes: #1201
Fixes: https://github.com/void-linux/void-packages/issues/47547
src/exiv2.cc