From 9c4f9c713f4f22eba7fd2854a617533c832714ee Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Wed, 1 Sep 2021 21:46:01 +0100
Subject: [PATCH 1/2] Regression test for
 https://github.com/Exiv2/exiv2/issues/1887

---
 test/data/issue_1887_poc.crw             | Bin 0 -> 102 bytes
 tests/bugfixes/github/test_issue_1887.py |  18 ++++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 test/data/issue_1887_poc.crw
 create mode 100644 tests/bugfixes/github/test_issue_1887.py

diff --git a/test/data/issue_1887_poc.crw b/test/data/issue_1887_poc.crw
new file mode 100644
index 0000000000000000000000000000000000000000..bfbdc103e95176879bc384c0f40962bb98dbf02f
GIT binary patch
literal 102
zcmebDRA69W@NjhuaCUYH`hR2E|F>L!{&O+x`k&SO=J)^mj124=vOpD@Knww)Fa`r7
Zg!P}H4#;3)I3Nv^;o<<XWMEtd1^|mm6BGad

literal 0
HcmV?d00001

diff --git a/tests/bugfixes/github/test_issue_1887.py b/tests/bugfixes/github/test_issue_1887.py
new file mode 100644
index 0000000000..da5262dde9
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_1887.py
@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, path, check_no_ASAN_UBSAN_errors
+
+
+class OutOfBoundsReadInCrwMapDecode0x080a(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1887
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1887"
+
+    filename = path("$data_path/issue_1887_poc.crw")
+    commands = ["$exiv2 $filename"]
+    stderr = [""]
+    retval = [0]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors

From bd211a90ac3c383b13db7f42f18c3dd7cb717192 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 2 Sep 2021 10:26:08 +0100
Subject: [PATCH 2/2] Credit to OSS-Fuzz:
 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37889 Avoid reading 1
 byte off the end when the string does not contain a '\0' byte.

---
 src/crwimage_int.cpp | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/src/crwimage_int.cpp b/src/crwimage_int.cpp
index a2a28604d2..98785408c7 100644
--- a/src/crwimage_int.cpp
+++ b/src/crwimage_int.cpp
@@ -826,22 +826,20 @@ namespace Exiv2 {
         ExifKey key1("Exif.Image.Make");
         Value::UniquePtr value1 = Value::create(ciffComponent.typeId());
         uint32_t i = 0;
-        for (;    i < ciffComponent.size()
-               && ciffComponent.pData()[i] != '\0'; ++i) {
+        while (i < ciffComponent.size() && ciffComponent.pData()[i++] != '\0') {
             // empty
         }
-        value1->read(ciffComponent.pData(), ++i, byteOrder);
+        value1->read(ciffComponent.pData(), i, byteOrder);
         image.exifData().add(key1, value1.get());
 
         // Model
         ExifKey key2("Exif.Image.Model");
         Value::UniquePtr value2 = Value::create(ciffComponent.typeId());
         uint32_t j = i;
-        for (;    i < ciffComponent.size()
-               && ciffComponent.pData()[i] != '\0'; ++i) {
+        while (i < ciffComponent.size() && ciffComponent.pData()[i++] != '\0') {
             // empty
         }
-        value2->read(ciffComponent.pData() + j, i - j + 1, byteOrder);
+        value2->read(ciffComponent.pData() + j, i - j, byteOrder);
         image.exifData().add(key2, value2.get());
     } // CrwMap::decode0x080a
 
@@ -979,11 +977,10 @@ namespace Exiv2 {
             else if (ciffComponent.typeId() == asciiString) {
                 // determine size from the data, by looking for the first 0
                 uint32_t i = 0;
-                for (;    i < ciffComponent.size()
-                       && ciffComponent.pData()[i] != '\0'; ++i) {
+                while (i < ciffComponent.size() && ciffComponent.pData()[i++] != '\0') {
                     // empty
                 }
-                size = ++i;
+                size = i;
             }
             else {
                 // by default, use the size from the directory entry