From d30c95d07e647535f4c9fe6fe4a559e978d25891 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 1 Jul 2021 12:33:20 +0100
Subject: [PATCH] fix incorrect loop condition (#1752)

---
 src/jp2image.cpp                              |   2 +-
 test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2   | Bin 0 -> 1692 bytes
 .../github/test_issue_ghsa_8949_hhfh_j7rj.py  |  11 +++++------
 .../github/test_issue_ghsa_mxw9_qx4c_6m8v.py  |  18 ++++++++++++++++++
 4 files changed, 24 insertions(+), 7 deletions(-)
 create mode 100644 test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2
 create mode 100644 tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py

diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index d880297a92..de4daf7546 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -655,7 +655,7 @@ static void boxes_check(size_t b,size_t m)
         auto p = reinterpret_cast<char*>(boxBuf.pData_);
         bool          bWroteColor = false ;
 
-        while ( count < length || !bWroteColor ) {
+        while ( count < length && !bWroteColor ) {
             enforce(sizeof(Jp2BoxHeader) <= length - count, Exiv2::kerCorruptedMetadata);
             auto pSubBox = reinterpret_cast<Jp2BoxHeader*>(p + count);
 
diff --git a/test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2 b/test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2
new file mode 100644
index 0000000000000000000000000000000000000000..47ad82ee7123a3b0aa2541295f5ca098bd0ccfae
GIT binary patch
literal 1692
zcmds2K}#D!6#gcwQDbAGg!Wd3J(WUg&`U|<f~a7`LXgtl3hmCW*$|U-vw?bPMTK69
zARfH-?A1TfKj7IPB89#;yKc0MsbEi?!_0fLZ@+o--uK=Bc+_f0na_R80Vw&=Zm-o_
zkR+oRuVvDkq&^OsDg@5=N&X3IVuEc@aJ%hLm;n-?KLB6?&{##96K@1>jP_<qg)1<E
z{WEXIoxvbb8@=r}f$y(<4*asS(O9V0pJS5TTVx;a7&9V+6CwHQ1EO%hoZK0OLqk#x
z-msISauP@3!W@OuzefQ$!&ekUCg?>$x8vlblr`m6`^O(!UWLZn#!JcTaJ;HiY_gL5
zXv_1fs_PDRyiQbqv1Gr~M$3A}FFX-eeSLKc%$J(5^olXi{uokPPnRxl(Yh<iI%Q=^
z)7lt;A(6gEyMrWjXdUYMU;s3!ETEcH7e)Ylq7TK>l-Bo4=q<1eX_lDNH_MWo)wjHw
z$?}!Q_W(P&wnchgOp@V|HqH|TnWhXdE2i`w>vM^{P#mT>WY2hIK!Kfh_4S9&_L8l<
z^2)mH43k1q#2Qapc*<IBK2(0S9q6>mSX*vK4v@P(h;Xl+`9g=xQf`F#Cryoc;)e42
zZutN4<whSh^Myk7K)x_S!F@lfDgPjol>Tv7H+plhIZfUW%cu?RaT`1~wZS}}XdKCl
RVZ<Jm*3Bm;Eiry_egg(t96kU5

literal 0
HcmV?d00001

diff --git a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
index c98b3815eb..44f6a906cb 100644
--- a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
+++ b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 
-from system_tests import CaseMeta, path
-
+from system_tests import CaseMeta, CopyTmpFiles, path
+@CopyTmpFiles("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2","$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
 
 class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
     """
@@ -10,13 +10,12 @@ class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
     """
     url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj"
 
-    filename1 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
-    filename2 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
+    filename1 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
+    filename2 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
     commands = ["$exiv2 in $filename1"]
     stdout = [""]
     stderr = [
 """Error: XMP Toolkit error 201: XML parsing failure
 Warning: Failed to decode XMP metadata.
-$filename1: Could not write metadata to file: $kerCorruptedMetadata
 """]
-    retval = [1]
+    retval = [0]
diff --git a/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py b/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
new file mode 100644
index 0000000000..8f8b6676cf
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+@CopyTmpFiles("$data_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
+
+class Jp2ImageEncodeJp2HeaderOutOfBoundsRead2(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v
+    """
+    url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v"
+
+    filename = path("$tmp_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
+    commands = ["$exiv2 rm $filename"]
+    stdout = [""]
+    retval = [0]
+
+    compare_stderr = check_no_ASAN_UBSAN_errors