• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* exif-data.c
2  *
3  * Copyright (c) 2001 Lutz Mueller <lutz@users.sourceforge.net>
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the
17  * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
18  * Boston, MA  02110-1301  USA.
19  *
20  * SPDX-License-Identifier: LGPL-2.0-or-later
21  */
22 
23 #include <config.h>
24 
25 #include <libexif/exif-mnote-data.h>
26 #include <libexif/exif-data.h>
27 #include <libexif/exif-ifd.h>
28 #include <libexif/exif-mnote-data-priv.h>
29 #include <libexif/exif-utils.h>
30 #include <libexif/exif-loader.h>
31 #include <libexif/exif-log.h>
32 #include <libexif/i18n.h>
33 #include <libexif/exif-system.h>
34 
35 /*#include <libexif/apple/exif-mnote-data-apple.h>*/
36 #include <libexif/canon/exif-mnote-data-canon.h>
37 #include <libexif/fuji/exif-mnote-data-fuji.h>
38 #include <libexif/olympus/exif-mnote-data-olympus.h>
39 #include <libexif/pentax/exif-mnote-data-pentax.h>
40 #include <libexif/huawei/exif-mnote-data-huawei.h>
41 
42 #include <math.h>
43 #include <stdlib.h>
44 #include <stdio.h>
45 #include <string.h>
46 
47 #undef JPEG_MARKER_SOI
48 #define JPEG_MARKER_SOI  0xd8
49 #undef JPEG_MARKER_APP0
50 #define JPEG_MARKER_APP0 0xe0
51 #undef JPEG_MARKER_APP1
52 #define JPEG_MARKER_APP1 0xe1
53 #undef JPEG_HEADER_LEN
54 #define JPEG_HEADER_LEN 6
55 #define ENTRY_SIZE 12
56 
57 #define CHECKOVERFLOW(offset,datasize,structsize) (( (offset) >= (datasize)) || ((structsize) > (datasize)) || ((offset) > (datasize) - (structsize) ))
58 
59 static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
60 
61 struct _ExifDataPrivate
62 {
63 	ExifByteOrder order;
64 
65 	ExifMnoteData *md;
66 
67 	ExifLog *log;
68 	ExifMem *mem;
69 
70 	unsigned int ref_count;
71 
72 	/* Temporarily used while loading data */
73 	unsigned int offset_mnote;
74 
75 	ExifDataOption options;
76 	ExifDataType data_type;
77 };
78 
79 static void *
exif_data_alloc(ExifData * data,unsigned int i)80 exif_data_alloc (ExifData *data, unsigned int i)
81 {
82 	void *d;
83 
84 	if (!data || !i)
85 		return NULL;
86 
87 	d = exif_mem_alloc (data->priv->mem, i);
88 	if (d)
89 		return d;
90 
91 	EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", i);
92 	return NULL;
93 }
94 
95 ExifMnoteData *
exif_data_get_mnote_data(ExifData * d)96 exif_data_get_mnote_data (ExifData *d)
97 {
98 	return (d && d->priv) ? d->priv->md : NULL;
99 }
100 
101 ExifMem *
exif_data_get_priv_mem(ExifData * d)102 exif_data_get_priv_mem (ExifData *d)
103 {
104 	return (d && d->priv) ? d->priv->mem : NULL;
105 }
106 
107 void
exif_data_set_priv_md(ExifData * d,ExifMnoteData * md)108 exif_data_set_priv_md (ExifData *d, ExifMnoteData *md)
109 {
110 	if (d && d->priv) {
111 		d->priv->md = md;
112 	}
113 }
114 
115 ExifData *
exif_data_new(void)116 exif_data_new (void)
117 {
118 	ExifMem *mem = exif_mem_new_default ();
119 	ExifData *d = exif_data_new_mem (mem);
120 
121 	exif_mem_unref (mem);
122 
123 	return d;
124 }
125 
126 ExifData *
exif_data_new_mem(ExifMem * mem)127 exif_data_new_mem (ExifMem *mem)
128 {
129 	ExifData *data;
130 	unsigned int i;
131 
132 	if (!mem)
133 		return NULL;
134 
135 	data = exif_mem_alloc (mem, sizeof (ExifData));
136 	if (!data)
137 		return (NULL);
138 	data->priv = exif_mem_alloc (mem, sizeof (ExifDataPrivate));
139 	if (!data->priv) {
140 	  	exif_mem_free (mem, data);
141 		return (NULL);
142 	}
143 	data->priv->ref_count = 1;
144 
145 	data->priv->mem = mem;
146 	exif_mem_ref (mem);
147 
148 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
149 		data->ifd[i] = exif_content_new_mem (data->priv->mem);
150 		if (!data->ifd[i]) {
151 			exif_data_free (data);
152 			return (NULL);
153 		}
154 		data->ifd[i]->parent = data;
155 	}
156 
157 	/* Default options */
158 #ifndef NO_VERBOSE_TAG_STRINGS
159 	/*
160 	 * When the tag list is compiled away, setting this option prevents
161 	 * any tags from being loaded
162 	 */
163 	exif_data_set_option (data, EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS);
164 #endif
165 	exif_data_set_option (data, EXIF_DATA_OPTION_FOLLOW_SPECIFICATION);
166 
167 	/* Default data type: none */
168 	exif_data_set_data_type (data, EXIF_DATA_TYPE_COUNT);
169 
170 	return (data);
171 }
172 
173 ExifData *
exif_data_new_from_data(const unsigned char * data,unsigned int size)174 exif_data_new_from_data (const unsigned char *data, unsigned int size)
175 {
176 	ExifData *edata;
177 
178 	edata = exif_data_new ();
179 	exif_data_load_data (edata, data, size);
180 	return (edata);
181 }
182 
183 static int
exif_data_load_data_entry(ExifData * data,ExifEntry * entry,const unsigned char * d,unsigned int size,unsigned int offset)184 exif_data_load_data_entry (ExifData *data, ExifEntry *entry,
185 			   const unsigned char *d,
186 			   unsigned int size, unsigned int offset)
187 {
188 	unsigned int s, doff;
189 
190 	entry->tag        = exif_get_short (d + offset + 0, data->priv->order);
191 	entry->format     = exif_get_short (d + offset + 2, data->priv->order);
192 	entry->components = exif_get_long  (d + offset + 4, data->priv->order);
193 
194 	/* FIXME: should use exif_tag_get_name_in_ifd here but entry->parent
195 	 * has not been set yet
196 	 */
197 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
198 		  "Loading entry 0x%x ('%s')...", entry->tag,
199 		  exif_tag_get_name (entry->tag));
200 
201 	/* {0,1,2,4,8} x { 0x00000000 .. 0xffffffff }
202 	 *   -> { 0x000000000 .. 0x7fffffff8 } */
203 	s = exif_format_get_size(entry->format) * entry->components;
204 	if ((s < entry->components) || (s == 0)){
205 		return 0;
206 	}
207 
208 	/*
209 	 * Size? If bigger than 4 bytes, the actual data is not
210 	 * in the entry but somewhere else (offset).
211 	 */
212 	if (s > 4)
213 		doff = exif_get_long (d + offset + 8, data->priv->order);
214 	else
215 		doff = offset + 8;
216 
217 	/* Sanity checks */
218 	if (doff >= size) {
219 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
220 				  "Tag starts past end of buffer (%u > %u)", doff, size);
221 		return 0;
222 	}
223 
224 	if (s > size - doff) {
225 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
226 				  "Tag data goes past end of buffer (%u > %u)", doff+s, size);
227 		return 0;
228 	}
229 
230 	entry->data = exif_data_alloc (data, s);
231 	if (entry->data) {
232 		entry->size = s;
233 		memcpy (entry->data, d + doff, s);
234         entry->offset = doff;
235 	} else {
236 		EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", s);
237 		return 0;
238 	}
239 
240 	/* If this is the MakerNote, remember the offset */
241 	if (entry->tag == EXIF_TAG_MAKER_NOTE) {
242 		if (!entry->data) {
243 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
244 					  "MakerNote found with empty data");
245 		} else if (entry->size > 6) {
246 			exif_log (data->priv->log,
247 					       EXIF_LOG_CODE_DEBUG, "ExifData",
248 					       "MakerNote found (%02x %02x %02x %02x "
249 					       "%02x %02x %02x...).",
250 					       entry->data[0], entry->data[1], entry->data[2],
251 					       entry->data[3], entry->data[4], entry->data[5],
252 					       entry->data[6]);
253 		}
254 
255 		if (!data->priv->offset_mnote) {
256 			data->priv->offset_mnote = doff;
257 		}
258 		if (entry->data && (entry->size >= 8) &&
259 			!memcmp(entry->data, HUAWEI_HEADER, 8)) {
260 			data->priv->offset_mnote = doff;
261 		}
262 	}
263 	return 1;
264 }
265 
266 static void
exif_data_save_data_entry(ExifData * data,ExifEntry * e,unsigned char ** d,unsigned int * ds,unsigned int offset)267 exif_data_save_data_entry (ExifData *data, ExifEntry *e,
268 			   unsigned char **d, unsigned int *ds,
269 			   unsigned int offset)
270 {
271 	unsigned int doff, s;
272 	unsigned int ts;
273 
274 	if (!data || !data->priv)
275 		return;
276 
277 	/*
278 	 * Each entry is 12 bytes long. The memory for the entry has
279 	 * already been allocated.
280 	 */
281 	exif_set_short (*d + 6 + offset + 0,
282 			data->priv->order, (ExifShort) e->tag);
283 	exif_set_short (*d + 6 + offset + 2,
284 			data->priv->order, (ExifShort) e->format);
285 
286 	if (!(data->priv->options & EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE)) {
287 		/* If this is the maker note tag, update it. */
288 		if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
289 			if (is_huawei_md(data->priv->md) &&
290 				e->data && (e->size >= 8) &&
291 				!memcmp(e->data, HUAWEI_HEADER, 8)) {
292 					/* TODO: this is using the wrong ExifMem to free e->data */
293 					exif_mem_free (data->priv->mem, e->data);
294 					e->data = NULL;
295 					e->size = 0;
296 					exif_mnote_data_set_offset (data->priv->md, *ds - 6);
297 					exif_mnote_data_save (data->priv->md, &e->data, &e->size);
298 					e->components = e->size;
299 					if (exif_format_get_size (e->format) != 1) {
300 						/* e->format is taken from input code,
301 						* but we need to make sure it is a 1 byte
302 						* entity due to the multiplication below. */
303 						e->format = EXIF_FORMAT_UNDEFINED;
304 					}
305 				}
306 		}
307 	}
308 
309 	exif_set_long  (*d + 6 + offset + 4,
310 			data->priv->order, e->components);
311 
312 	/*
313 	 * Size? If bigger than 4 bytes, the actual data is not in
314 	 * the entry but somewhere else.
315 	 */
316 	s = exif_format_get_size (e->format) * e->components;
317 	if (s > 4) {
318 		unsigned char *t;
319 		doff = *ds - 6;
320 		ts = *ds + s;
321 
322 		/*
323 		 * According to the TIFF specification,
324 		 * the offset must be an even number. If we need to introduce
325 		 * a padding byte, we set it to 0.
326 		 */
327 		if (s & 1)
328 			ts++;
329 		t = exif_mem_realloc (data->priv->mem, *d, ts);
330 		if (!t) {
331 			EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
332 		  	return;
333 		}
334 		*d = t;
335 		*ds = ts;
336 		exif_set_long (*d + 6 + offset + 8, data->priv->order, doff);
337 		if (s & 1)
338 			*(*d + *ds - 1) = '\0';
339 
340 	} else
341 		doff = offset + 8;
342 
343 	/* Write the data. Fill unneeded bytes with 0. Do not crash with
344 	 * e->data is NULL */
345 	if (e->data) {
346 		unsigned int len = s;
347 		if (e->size < s) len = e->size;
348 		memcpy (*d + 6 + doff, e->data, len);
349 	} else {
350 		memset (*d + 6 + doff, 0, s);
351 	}
352 	if (s < 4)
353 		memset (*d + 6 + doff + s, 0, (4 - s));
354 }
355 
356 static void
exif_data_save_data_entry_general(ExifData * data,ExifEntry * e,unsigned char ** d,unsigned int * ds,unsigned int offset)357 exif_data_save_data_entry_general (ExifData *data, ExifEntry *e,
358 								   unsigned char **d, unsigned int *ds,
359 								   unsigned int offset)
360 {
361 	unsigned int doff, s;
362 	unsigned int ts;
363 
364 	if (!data || !data->priv)
365 		return;
366 
367 	/*
368 	 * Each entry is 12 bytes long. The memory for the entry has
369 	 * already been allocated.
370 	 */
371 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0,
372 		data->priv->order, (ExifShort)e->tag);
373 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2,
374 		data->priv->order, (ExifShort)e->format);
375 
376 	if (!(data->priv->options & EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE)) {
377 		/* If this is the maker note tag, update it. */
378 		if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
379 			if (is_huawei_md(data->priv->md) &&
380 				e->data && (e->size >= 8) &&
381 				!memcmp(e->data, HUAWEI_HEADER, 8)) {
382 					/* TODO: this is using the wrong ExifMem to free e->data */
383 					exif_mem_free(data->priv->mem, e->data);
384 					e->data = NULL;
385 					e->size = 0;
386 					exif_mnote_data_set_offset(data->priv->md, *ds - 6 + JPEG_HEADER_LEN);
387 					exif_mnote_data_save(data->priv->md, &e->data, &e->size);
388 					e->components = e->size;
389 					if (exif_format_get_size(e->format) != 1) {
390 						/* e->format is taken from input code,
391 						* but we need to make sure it is a 1 byte
392 						* entity due to the multiplication below. */
393 						e->format = EXIF_FORMAT_UNDEFINED;
394 					}
395 				}
396 		}
397 	}
398 
399 	exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4,
400 		data->priv->order, e->components);
401 
402 	/*
403 	 * Size? If bigger than 4 bytes, the actual data is not in
404 	 * the entry but somewhere else.
405 	 */
406 	s = exif_format_get_size(e->format) * e->components;
407 	if (s > 4) {
408 		unsigned char* t;
409 		doff = *ds - 6 + JPEG_HEADER_LEN;
410 		ts = *ds + s;
411 
412 		/*
413 		 * According to the TIFF specification,
414 		 * the offset must be an even number. If we need to introduce
415 		 * a padding byte, we set it to 0.
416 		 */
417 		if (s & 1)
418 			ts++;
419 		t = exif_mem_realloc(data->priv->mem, *d, ts);
420 		if (!t) {
421 			EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", ts);
422 			return;
423 		}
424 		*d = t;
425 		*ds = ts;
426 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order, doff);
427 		if (s & 1)
428 			*(*d + *ds - 1) = '\0';
429 
430 	} else
431 		doff = offset + 8;
432 
433 	/* Write the data. Fill unneeded bytes with 0. Do not crash with
434 	 * e->data is NULL */
435 	if (e->data) {
436 		unsigned int len = s;
437 		if (e->size < s) len = e->size;
438         if (!d || !(*d) || CHECKOVERFLOW(6 - JPEG_HEADER_LEN + doff, *ds, len)) {
439             return;
440         }
441 		memcpy(*d + 6 - JPEG_HEADER_LEN + doff, e->data, len);
442 	} else {
443 		memset(*d + 6 - JPEG_HEADER_LEN + doff, 0, s);
444 	}
445 	if (s < 4)
446 		memset(*d + 6 - JPEG_HEADER_LEN + doff + s, 0, (4 - s));
447 }
448 
449 static void
exif_data_load_data_thumbnail(ExifData * data,const unsigned char * d,unsigned int ds,ExifLong o,ExifLong s)450 exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
451 			       unsigned int ds, ExifLong o, ExifLong s)
452 {
453 	/* Sanity checks */
454 	if (o >= ds) {
455 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
456 		return;
457 	}
458 	if (CHECKOVERFLOW(o,ds,s)) {
459 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
460 		return;
461 	}
462 	if (data->data)
463 		exif_mem_free (data->priv->mem, data->data);
464 	if (!(data->data = exif_data_alloc (data, s))) {
465 		EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", s);
466 		data->size = 0;
467 		return;
468 	}
469 	data->size = s;
470 	memcpy (data->data, d + o, s);
471 }
472 
473 #undef CHECK_REC
474 #define CHECK_REC(i) 					\
475 if ((i) == ifd) {				\
476 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, \
477 		"ExifData", "Recursive entry in IFD "	\
478 		"'%s' detected. Skipping...",		\
479 		exif_ifd_get_name (i));			\
480 	break;						\
481 }							\
482 if (data->ifd[(i)]->count) {				\
483 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,	\
484 		"ExifData", "Attempt to load IFD "	\
485 		"'%s' multiple times detected. "	\
486 		"Skipping...",				\
487 		exif_ifd_get_name (i));			\
488 	break;						\
489 }
490 
491 /*! Calculate the recursion cost added by one level of IFD loading.
492  *
493  * The work performed is related to the cost in the exponential relation
494  *   work=1.1**cost
495  */
496 static unsigned int
level_cost(unsigned int n)497 level_cost(unsigned int n)
498 {
499     static const double log_1_1 = 0.09531017980432493;
500 
501 	/* Adding 0.1 protects against the case where n==1 */
502 	return ceil(log(n + 0.1)/log_1_1);
503 }
504 
505 static void
load_thumbnail_entry(ExifData * data,ExifTag tag,ExifIfd ifd,const unsigned char * d,unsigned int ds,unsigned int offset,unsigned i)506 load_thumbnail_entry (ExifData *data, ExifTag tag, ExifIfd ifd,
507 					  const unsigned char *d,
508 					  unsigned int ds, unsigned int offset, unsigned i)
509 {
510 	/*
511 		* If we don't know the tag, don't fail. It could be that new
512 		* versions of the standard have defined additional tags. Note that
513 		* 0 is a valid tag in the GPS IFD.
514 		*/
515 	if (!exif_tag_get_name_in_ifd (tag, ifd)) {
516 
517 		/*
518 			* Special case: Tag and format 0. That's against specification
519 			* (at least up to 2.2). But Photoshop writes it anyways.
520 			*/
521 		if (!d || CHECKOVERFLOW(offset + 12 * i, ds, 4) ||
522             !memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
523 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
524 					"Skipping empty entry at position %u in '%s'.", i,
525 					exif_ifd_get_name (ifd));
526 			return;
527 		}
528 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
529 				"Unknown tag 0x%04x (entry %u in '%s'). Please report this tag "
530 				"to <libexif-devel@lists.sourceforge.net>.", tag, i,
531 				exif_ifd_get_name (ifd));
532 		if (data->priv->options & EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS)
533 			return;
534 	}
535 	ExifEntry *entry = exif_entry_new_mem (data->priv->mem);
536 	if (!entry) {
537 			exif_log (data->priv->log, EXIF_LOG_CODE_NO_MEMORY, "ExifData",
538 									"Could not allocate memory");
539 			return;
540 	}
541 	if (exif_data_load_data_entry (data, entry, d, ds,
542 					offset + 12 * i))
543 		exif_content_add_entry (data->ifd[ifd], entry);
544 	exif_entry_unref (entry);
545 }
546 
547 /*! Load data for an IFD.
548  *
549  * \param[in,out] data #ExifData
550  * \param[in] ifd IFD to load
551  * \param[in] d pointer to buffer containing raw IFD data
552  * \param[in] ds size of raw data in buffer at \c d
553  * \param[in] offset offset into buffer at \c d at which IFD starts
554  * \param[in] recursion_cost factor indicating how expensive this recursive
555  * call could be
556  */
557 static void
exif_data_load_data_content(ExifData * data,ExifIfd ifd,const unsigned char * d,unsigned int ds,unsigned int offset,unsigned int recursion_cost)558 exif_data_load_data_content (ExifData *data, ExifIfd ifd,
559 			     const unsigned char *d,
560 			     unsigned int ds, unsigned int offset, unsigned int recursion_cost)
561 {
562 	ExifLong o, thumbnail_offset = 0, thumbnail_length = 0;
563 	ExifShort n;
564 	ExifEntry *entry;
565 	unsigned int i;
566 	ExifTag tag;
567 
568 	if (!data || !data->priv)
569 		return;
570 
571 	/* check for valid ExifIfd enum range */
572 	if ((((int)ifd) < 0) || ( ((int)ifd) >= EXIF_IFD_COUNT))
573 	  return;
574 
575 	if (recursion_cost > 170) {
576 		/*
577 		 * recursion_cost is a logarithmic-scale indicator of how expensive this
578 		 * recursive call might end up being. It is an indicator of the depth of
579 		 * recursion as well as the potential for worst-case future recursive
580 		 * calls. Since it's difficult to tell ahead of time how often recursion
581 		 * will occur, this assumes the worst by assuming every tag could end up
582 		 * causing recursion.
583 		 * The value of 170 was chosen to limit typical EXIF structures to a
584 		 * recursive depth of about 6, but pathological ones (those with very
585 		 * many tags) to only 2.
586 		 */
587 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
588 			  "Deep/expensive recursion detected!");
589 		return;
590 	}
591 
592 	/* Read the number of entries */
593 	if (CHECKOVERFLOW(offset, ds, 2)) {
594 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
595 			  "Tag data past end of buffer (%u+2 > %u)", offset, ds);
596 		return;
597 	}
598 	n = exif_get_short (d + offset, data->priv->order);
599 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
600 	          "Loading %hu entries...", n);
601 	offset += 2;
602 
603 	/* Check if we have enough data. */
604 	if (CHECKOVERFLOW(offset, ds, 12*n)) {
605 		n = (ds - offset) / 12;
606 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
607 				  "Short data; only loading %hu entries...", n);
608 	}
609 
610 	for (i = 0; i < n; i++) {
611 
612 		/* Check if we have enough data. */
613 		if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, sizeof(ExifShort))) {
614 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
615 					"Tag data past end of buffer (%u+2 > %u)", offset + ENTRY_SIZE * i, ds);
616 			return;
617 		}
618 
619 		tag = exif_get_short (d + offset + 12 * i, data->priv->order);
620 		switch (tag) {
621 		case EXIF_TAG_EXIF_IFD_POINTER:
622 		case EXIF_TAG_GPS_INFO_IFD_POINTER:
623 		case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
624 		case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH:
625 		case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
626 			o = exif_get_long (d + offset + 12 * i + 8,
627 					   data->priv->order);
628 			if (o >= ds) {
629 				exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
630 					  "Tag data past end of buffer (%u > %u)", offset+2, ds);
631 				if (recursion_cost > 0)
632 					return;
633 				break;
634 			}
635 			/* FIXME: IFD_POINTER tags aren't marked as being in a
636 			 * specific IFD, so exif_tag_get_name_in_ifd won't work
637 			 */
638 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
639 				  "Sub-IFD entry 0x%x ('%s') at %u.", tag,
640 				  exif_tag_get_name(tag), o);
641 			switch (tag) {
642 			case EXIF_TAG_EXIF_IFD_POINTER:
643 				CHECK_REC (EXIF_IFD_EXIF)
644 				exif_data_load_data_content (data, EXIF_IFD_EXIF, d, ds, o,
645 					recursion_cost + level_cost(n));
646 				break;
647 			case EXIF_TAG_GPS_INFO_IFD_POINTER:
648 				CHECK_REC (EXIF_IFD_GPS)
649 				exif_data_load_data_content (data, EXIF_IFD_GPS, d, ds, o,
650 					recursion_cost + level_cost(n));
651 				break;
652 			case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
653 				CHECK_REC (EXIF_IFD_INTEROPERABILITY)
654 				exif_data_load_data_content (data, EXIF_IFD_INTEROPERABILITY, d, ds, o,
655 					recursion_cost + level_cost(n));
656 				break;
657 			case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
658 				thumbnail_offset = o;
659 				if (thumbnail_offset && thumbnail_length)
660 					exif_data_load_data_thumbnail (data, d,
661 								       ds, thumbnail_offset,
662 								       thumbnail_length);
663 				load_thumbnail_entry(data, tag, ifd, d, ds, offset, i);
664 				break;
665 			case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH:
666 				thumbnail_length = o;
667 				if (thumbnail_offset && thumbnail_length)
668 					exif_data_load_data_thumbnail (data, d,
669 								       ds, thumbnail_offset,
670 								       thumbnail_length);
671 				load_thumbnail_entry(data, tag, ifd, d, ds, offset, i);
672 				break;
673 			default:
674 				return;
675 			}
676 			break;
677 		default:
678 			/*
679 			 * If we don't know the tag, don't fail. It could be that new
680 			 * versions of the standard have defined additional tags. Note that
681 			 * 0 is a valid tag in the GPS IFD.
682 			 */
683 			if (!exif_tag_get_name_in_ifd (tag, ifd)) {
684 
685 				/*
686 				 * Special case: Tag and format 0. That's against specification
687 				 * (at least up to 2.2). But Photoshop writes it anyways.
688 				 */
689 				if (!memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
690 					exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
691 						  "Skipping empty entry at position %u in '%s'.", i,
692 						  exif_ifd_get_name (ifd));
693 					break;
694 				}
695 				exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
696 					  "Unknown tag 0x%04x (entry %u in '%s'). Please report this tag "
697 					  "to <libexif-devel@lists.sourceforge.net>.", tag, i,
698 					  exif_ifd_get_name (ifd));
699 				if (data->priv->options & EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS)
700 					break;
701 			}
702 			entry = exif_entry_new_mem (data->priv->mem);
703 			if (!entry) {
704 				  exif_log (data->priv->log, EXIF_LOG_CODE_NO_MEMORY, "ExifData",
705                                           "Could not allocate memory");
706 				  return;
707 			}
708 			if (exif_data_load_data_entry (data, entry, d, ds,
709 						   offset + 12 * i))
710 				exif_content_add_entry (data->ifd[ifd], entry);
711 			exif_entry_unref (entry);
712 			break;
713 		}
714 	}
715 }
716 
717 static int
cmp_func(const unsigned char * p1,const unsigned char * p2,ExifByteOrder o)718 cmp_func (const unsigned char *p1, const unsigned char *p2, ExifByteOrder o)
719 {
720 	ExifShort tag1 = exif_get_short (p1, o);
721 	ExifShort tag2 = exif_get_short (p2, o);
722 
723 	return (tag1 < tag2) ? -1 : (tag1 > tag2) ? 1 : 0;
724 }
725 
726 static int
cmp_func_intel(const void * elem1,const void * elem2)727 cmp_func_intel (const void *elem1, const void *elem2)
728 {
729 	return cmp_func ((const unsigned char *) elem1,
730 			 (const unsigned char *) elem2, EXIF_BYTE_ORDER_INTEL);
731 }
732 
733 static int
cmp_func_motorola(const void * elem1,const void * elem2)734 cmp_func_motorola (const void *elem1, const void *elem2)
735 {
736 	return cmp_func ((const unsigned char *) elem1,
737 			 (const unsigned char *) elem2, EXIF_BYTE_ORDER_MOTOROLA);
738 }
739 
740 static void
exif_data_save_data_content(ExifData * data,ExifContent * ifd,unsigned char ** d,unsigned int * ds,unsigned int offset)741 exif_data_save_data_content (ExifData *data, ExifContent *ifd,
742 			     unsigned char **d, unsigned int *ds,
743 			     unsigned int offset)
744 {
745 	unsigned int j, n_ptr = 0, n_thumb = 0;
746 	ExifIfd i;
747 	unsigned char *t;
748 	unsigned int ts;
749 	unsigned int icount = 0;
750 
751 	if (!data || !data->priv || !ifd || !d || !ds)
752 		return;
753 
754 	for (i = 0; i < EXIF_IFD_COUNT; i++)
755 		if (ifd == data->ifd[i])
756 			break;
757 	if (i == EXIF_IFD_COUNT)
758 		return;	/* error */
759 
760 	/*
761 	 * Check if we need some extra entries for pointers or the thumbnail.
762 	 */
763 	switch (i) {
764 	case EXIF_IFD_0:
765 
766 		/*
767 		 * The pointer to IFD_EXIF is in IFD_0. The pointer to
768 		 * IFD_INTEROPERABILITY is in IFD_EXIF.
769 		 */
770 		if (data->ifd[EXIF_IFD_EXIF]->count ||
771 		    data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
772 			n_ptr++;
773 
774 		/* The pointer to IFD_GPS is in IFD_0. */
775 		if (data->ifd[EXIF_IFD_GPS]->count)
776 			n_ptr++;
777 
778 		break;
779 	case EXIF_IFD_1:
780 		if (data->size)
781 			n_thumb = 2;
782 		for (j = 0; j < ifd->count; j++) {
783 			if (ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH ||
784 				ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT) {
785 				icount++;
786 			}
787 		}
788 		ifd->count = ifd->count - icount;
789 		break;
790 	case EXIF_IFD_EXIF:
791 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
792 			n_ptr++;
793 	default:
794 		break;
795 	}
796 
797 	/*
798 	 * Allocate enough memory for all entries
799 	 * and the number of entries.
800 	 */
801 	ts = *ds + (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
802 	t = exif_mem_realloc (data->priv->mem, *d, ts);
803 	if (!t) {
804 		EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
805 	  	return;
806 	}
807 	*d = t;
808 	*ds = ts;
809 
810 	/* Save the number of entries */
811 	exif_set_short (*d + 6 + offset, data->priv->order,
812 			(ExifShort) (ifd->count + n_ptr + n_thumb));
813 	offset += 2;
814 
815 	/*
816 	 * Save each entry. Make sure that no memcpys from NULL pointers are
817 	 * performed
818 	 */
819 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
820 		  "Saving %i entries (IFD '%s', offset: %i)...",
821 		  ifd->count, exif_ifd_get_name (i), offset);
822 	for (j = 0; j < ifd->count; j++) {
823 		if (i == EXIF_IFD_1 &&
824 			(ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT ||
825 			ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH))
826 			continue;
827 		if (ifd->entries[j]) {
828 			exif_data_save_data_entry (data, ifd->entries[j], d, ds,
829 				offset + 12 * j);
830 		}
831 	}
832 
833 	offset += 12 * ifd->count;
834 
835 	/* Now save special entries. */
836 	switch (i) {
837 	case EXIF_IFD_0:
838 
839 		/*
840 		 * The pointer to IFD_EXIF is in IFD_0.
841 		 * However, the pointer to IFD_INTEROPERABILITY is in IFD_EXIF,
842 		 * therefore, if IFD_INTEROPERABILITY is not empty, we need
843 		 * IFD_EXIF even if latter is empty.
844 		 */
845 		if (data->ifd[EXIF_IFD_EXIF]->count ||
846 		    data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
847 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
848 					EXIF_TAG_EXIF_IFD_POINTER);
849 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
850 					EXIF_FORMAT_LONG);
851 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
852 					1);
853 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
854 					*ds - 6);
855 			exif_data_save_data_content (data,
856 						     data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6);
857 			offset += 12;
858 		}
859 
860 		/* The pointer to IFD_GPS is in IFD_0, too. */
861 		if (data->ifd[EXIF_IFD_GPS]->count) {
862 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
863 					EXIF_TAG_GPS_INFO_IFD_POINTER);
864 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
865 					EXIF_FORMAT_LONG);
866 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
867 					1);
868 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
869 					*ds - 6);
870 			exif_data_save_data_content (data,
871 						     data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6);
872 			offset += 12;
873 		}
874 
875 		break;
876 	case EXIF_IFD_EXIF:
877 
878 		/*
879 		 * The pointer to IFD_INTEROPERABILITY is in IFD_EXIF.
880 		 * See note above.
881 		 */
882 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
883 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
884 					EXIF_TAG_INTEROPERABILITY_IFD_POINTER);
885 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
886 					EXIF_FORMAT_LONG);
887 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
888 					1);
889 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
890 					*ds - 6);
891 			exif_data_save_data_content (data,
892 						     data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
893 						     *ds - 6);
894 			offset += 12;
895 		}
896 
897 		break;
898 	case EXIF_IFD_1:
899 
900 		/*
901 		 * Information about the thumbnail (if any) is saved in
902 		 * IFD_1.
903 		 */
904 		if (data->size) {
905 
906 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT */
907 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
908 					EXIF_TAG_JPEG_INTERCHANGE_FORMAT);
909 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
910 					EXIF_FORMAT_LONG);
911 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
912 					1);
913 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
914 					*ds - 6);
915 			ts = *ds + data->size;
916 			t = exif_mem_realloc (data->priv->mem, *d, ts);
917 			if (!t) {
918 				EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData",
919 						    ts);
920 			  	return;
921 			}
922 			*d = t;
923 			*ds = ts;
924 			memcpy (*d + *ds - data->size, data->data, data->size);
925 			offset += 12;
926 
927 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH */
928 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
929 					EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
930 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
931 					EXIF_FORMAT_LONG);
932 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
933 					1);
934 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
935 					data->size);
936 			offset += 12;
937 		}
938 
939 		break;
940 	default:
941 		break;
942 	}
943 
944 	/* Sort the directory according to TIFF specification */
945 	qsort (*d + 6 + offset - (ifd->count + n_ptr + n_thumb) * 12,
946 	       (ifd->count + n_ptr + n_thumb), 12,
947 	       (data->priv->order == EXIF_BYTE_ORDER_INTEL) ? cmp_func_intel : cmp_func_motorola);
948 
949 	/* Correctly terminate the directory */
950 	if (i == EXIF_IFD_0 && (data->ifd[EXIF_IFD_1]->count ||
951 				data->size)) {
952 
953 		/*
954 		 * We are saving IFD 0. Tell where IFD 1 starts and save
955 		 * IFD 1.
956 		 */
957 		exif_set_long (*d + 6 + offset, data->priv->order, *ds - 6);
958         if (data && data->remove_thumbnail != 1) {
959             exif_data_save_data_content (data, data->ifd[EXIF_IFD_1], d, ds,
960                                          *ds - 6);
961         }
962 	} else
963 		exif_set_long (*d + 6 + offset, data->priv->order, 0);
964 }
965 
966 static void
exif_data_save_data_content_general(ExifData * data,ExifContent * ifd,unsigned char ** d,unsigned int * ds,unsigned int offset)967 exif_data_save_data_content_general (ExifData* data, ExifContent* ifd,
968 									 unsigned char** d, unsigned int* ds,
969 									 unsigned int offset)
970 {
971 	unsigned int j, n_ptr = 0, n_thumb = 0;
972 	ExifIfd i;
973 	unsigned char* t;
974 	unsigned int ts;
975 
976 	if (!data || !data->priv || !ifd || !d || !ds)
977 		return;
978 
979 	for (i = 0; i < EXIF_IFD_COUNT; i++)
980 		if (ifd == data->ifd[i])
981 			break;
982 	if (i == EXIF_IFD_COUNT)
983 		return;	/* error */
984 
985 	/*
986 	 * Check if we need some extra entries for pointers or the thumbnail.
987 	 */
988 	switch (i) {
989 	case EXIF_IFD_0:
990 
991 		/*
992 		 * The pointer to IFD_EXIF is in IFD_0. The pointer to
993 		 * IFD_INTEROPERABILITY is in IFD_EXIF.
994 		 */
995 		if (data->ifd[EXIF_IFD_EXIF]->count ||
996 			data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
997 			n_ptr++;
998 
999 		/* The pointer to IFD_GPS is in IFD_0. */
1000 		if (data->ifd[EXIF_IFD_GPS]->count)
1001 			n_ptr++;
1002 
1003 		break;
1004 	case EXIF_IFD_1:
1005 		if (data->size)
1006 			n_thumb = 2;
1007 		break;
1008 	case EXIF_IFD_EXIF:
1009 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
1010 			n_ptr++;
1011 	default:
1012 		break;
1013 	}
1014 
1015 	/*
1016 	 * Allocate enough memory for all entries
1017 	 * and the number of entries.
1018 	 */
1019 	ts = *ds + (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
1020 	t = exif_mem_realloc(data->priv->mem, *d, ts);
1021 	if (!t) {
1022 		EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", ts);
1023 		return;
1024 	}
1025 	*d = t;
1026 	*ds = ts;
1027 
1028 	/* Save the number of entries */
1029 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order,
1030 		(ExifShort)(ifd->count + n_ptr + n_thumb));
1031 	offset += 2;
1032 
1033 	/*
1034 	 * Save each entry. Make sure that no memcpys from NULL pointers are
1035 	 * performed
1036 	 */
1037 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1038 		"Saving %i entries (IFD '%s', offset: %i)...",
1039 		ifd->count, exif_ifd_get_name(i), offset);
1040 	printf("current ifd->count %u\n", ifd->count);
1041 	for (j = 0; j < ifd->count; j++) {
1042 		if (ifd->entries[j]) {
1043 			exif_data_save_data_entry_general(data, ifd->entries[j], d, ds,
1044 				offset + 12 * j);
1045 		}
1046 	}
1047 
1048 	offset += 12 * ifd->count;
1049 
1050 	/* Now save special entries. */
1051 	switch (i) {
1052 	case EXIF_IFD_0:
1053 
1054 		/*
1055 		 * The pointer to IFD_EXIF is in IFD_0.
1056 		 * However, the pointer to IFD_INTEROPERABILITY is in IFD_EXIF,
1057 		 * therefore, if IFD_INTEROPERABILITY is not empty, we need
1058 		 * IFD_EXIF even if latter is empty.
1059 		 */
1060 		if (data->ifd[EXIF_IFD_EXIF]->count ||
1061 			data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
1062 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1063 				EXIF_TAG_EXIF_IFD_POINTER);
1064 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1065 				EXIF_FORMAT_LONG);
1066 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1067 				1);
1068 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1069 				*ds - 6 + JPEG_HEADER_LEN);
1070 			exif_data_save_data_content_general(data,
1071 				data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6 + JPEG_HEADER_LEN);
1072 			offset += 12;
1073 		}
1074 
1075 		/* The pointer to IFD_GPS is in IFD_0, too. */
1076 		if (data->ifd[EXIF_IFD_GPS]->count) {
1077 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1078 				EXIF_TAG_GPS_INFO_IFD_POINTER);
1079 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1080 				EXIF_FORMAT_LONG);
1081 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1082 				1);
1083 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1084 				*ds - 6 + JPEG_HEADER_LEN);
1085 			exif_data_save_data_content_general(data,
1086 				data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6 + JPEG_HEADER_LEN);
1087 			offset += 12;
1088 		}
1089 
1090 		break;
1091 	case EXIF_IFD_EXIF:
1092 
1093 		/*
1094 		 * The pointer to IFD_INTEROPERABILITY is in IFD_EXIF.
1095 		 * See note above.
1096 		 */
1097 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
1098 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1099 				EXIF_TAG_INTEROPERABILITY_IFD_POINTER);
1100 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1101 				EXIF_FORMAT_LONG);
1102 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1103 				1);
1104 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1105 				*ds - 6 + JPEG_HEADER_LEN);
1106 			exif_data_save_data_content_general(data,
1107 				data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
1108 				*ds - 6 + JPEG_HEADER_LEN);
1109 			offset += 12;
1110 		}
1111 
1112 		break;
1113 	case EXIF_IFD_1:
1114 
1115 		/*
1116 		 * Information about the thumbnail (if any) is saved in
1117 		 * IFD_1.
1118 		 */
1119 		if (data->size) {
1120 
1121 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT */
1122 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1123 				EXIF_TAG_JPEG_INTERCHANGE_FORMAT);
1124 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1125 				EXIF_FORMAT_LONG);
1126 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1127 				1);
1128 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1129 				*ds - 6 + JPEG_HEADER_LEN);
1130 			ts = *ds + data->size;
1131 			t = exif_mem_realloc(data->priv->mem, *d, ts);
1132 			if (!t) {
1133 				EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData",
1134 					ts);
1135 				return;
1136 			}
1137 			*d = t;
1138 			*ds = ts;
1139 			memcpy(*d + *ds - data->size, data->data, data->size);
1140 			offset += 12;
1141 
1142 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH */
1143 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1144 				EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
1145 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1146 				EXIF_FORMAT_LONG);
1147 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1148 				1);
1149 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1150 				data->size);
1151 			offset += 12;
1152 		}
1153 
1154 		break;
1155 	default:
1156 		break;
1157 	}
1158 
1159 	/* Sort the directory according to TIFF specification */
1160 	qsort(*d + 6 - JPEG_HEADER_LEN + offset - (ifd->count + n_ptr + n_thumb) * 12,
1161 		(ifd->count + n_ptr + n_thumb), 12,
1162 		(data->priv->order == EXIF_BYTE_ORDER_INTEL) ? cmp_func_intel : cmp_func_motorola);
1163 
1164 	/* Correctly terminate the directory */
1165 	if (i == EXIF_IFD_0 && (data->ifd[EXIF_IFD_1]->count ||
1166 		data->size)) {
1167 
1168 		/*
1169 		 * We are saving IFD 0. Tell where IFD 1 starts and save
1170 		 * IFD 1.
1171 		 */
1172 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order, *ds - 6 + JPEG_HEADER_LEN);
1173 		exif_data_save_data_content_general(data, data->ifd[EXIF_IFD_1], d, ds,
1174 			*ds - 6 + JPEG_HEADER_LEN);
1175 	}
1176 	else
1177 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order, 0);
1178 }
1179 
1180 typedef enum {
1181 	EXIF_DATA_TYPE_MAKER_NOTE_NONE		= 0,
1182 	EXIF_DATA_TYPE_MAKER_NOTE_CANON		= 1,
1183 	EXIF_DATA_TYPE_MAKER_NOTE_OLYMPUS	= 2,
1184 	EXIF_DATA_TYPE_MAKER_NOTE_PENTAX	= 3,
1185 	EXIF_DATA_TYPE_MAKER_NOTE_NIKON		= 4,
1186 	EXIF_DATA_TYPE_MAKER_NOTE_CASIO		= 5,
1187 	EXIF_DATA_TYPE_MAKER_NOTE_FUJI 		= 6
1188 } ExifDataTypeMakerNote;
1189 
1190 /*! If MakerNote is recognized, load it.
1191  *
1192  * \param[in,out] data #ExifData
1193  * \param[in] d pointer to raw EXIF data
1194  * \param[in] ds length of data at d
1195  */
1196 static void
interpret_maker_note(ExifData * data,const unsigned char * d,unsigned int ds)1197 interpret_maker_note(ExifData *data, const unsigned char *d, unsigned int ds)
1198 {
1199 	int mnoteid;
1200 	ExifEntry* e = exif_content_get_huawei_makenote_entry(data->ifd[EXIF_IFD_EXIF]);
1201 
1202 	if (!e)
1203 		return;
1204 
1205 	if ((mnoteid = exif_mnote_data_olympus_identify (data, e)) != 0) {
1206 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1207 			"ExifData", "Olympus MakerNote variant type %d", mnoteid);
1208 		data->priv->md = exif_mnote_data_olympus_new (data->priv->mem);
1209 
1210 	} else if ((mnoteid = exif_mnote_data_canon_identify (data, e)) != 0) {
1211 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1212 			"ExifData", "Canon MakerNote variant type %d", mnoteid);
1213 		data->priv->md = exif_mnote_data_canon_new (data->priv->mem, data->priv->options);
1214 
1215 	} else if ((mnoteid = exif_mnote_data_fuji_identify (data, e)) != 0) {
1216 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1217 			"ExifData", "Fuji MakerNote variant type %d", mnoteid);
1218 		data->priv->md = exif_mnote_data_fuji_new (data->priv->mem);
1219 
1220 	/* NOTE: Must do Pentax detection last because some of the
1221 	 * heuristics are pretty general. */
1222 	} else if ((mnoteid = exif_mnote_data_pentax_identify (data, e)) != 0) {
1223 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1224 			"ExifData", "Pentax MakerNote variant type %d", mnoteid);
1225 		data->priv->md = exif_mnote_data_pentax_new (data->priv->mem);
1226 	} else if ((mnoteid = exif_mnote_data_huawei_identify (data, e)) != 0) {
1227 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1228 			"ExifData", "Huawei MakerNote variant type %d", mnoteid);
1229 		data->priv->md = exif_mnote_data_huawei_new (data->priv->mem);
1230 	}
1231 /* Marcus: disabled until apple makernote can also be saved
1232 	else if ((mnoteid = exif_mnote_data_apple_identify (data, e)) != 0) {
1233 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1234 			"ExifData", "Apple MakerNote variant type %d", mnoteid);
1235 		data->priv->md = exif_mnote_data_apple_new (data->priv->mem);
1236 	} else if ((mnoteid = exif_mnote_data_huawei_identify (data, e)) != 0) {
1237 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1238 			"ExifData", "Huawei MakerNote variant type %d", mnoteid);
1239 		data->priv->md = exif_mnote_data_huawei_new (data->priv->mem);
1240 	}
1241 */
1242 
1243 	/*
1244 	 * If we are able to interpret the maker note, do so.
1245 	 */
1246 	if (data->priv->md) {
1247 		exif_mnote_data_log (data->priv->md, data->priv->log);
1248 		exif_mnote_data_set_byte_order (data->priv->md,
1249 						data->priv->order);
1250 		exif_mnote_data_set_offset (data->priv->md,
1251 					    data->priv->offset_mnote);
1252 		exif_mnote_data_load (data->priv->md, d, ds);
1253 	}
1254 }
1255 
1256 #define LOG_TOO_SMALL \
1257 exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", \
1258 		_("Size of data too small to allow for EXIF data."))
1259 
1260 void
exif_data_load_data(ExifData * data,const unsigned char * d_orig,unsigned int ds)1261 exif_data_load_data (ExifData *data, const unsigned char *d_orig,
1262 		     unsigned int ds)
1263 {
1264 	unsigned int l;
1265 	ExifLong offset;
1266 	ExifShort n;
1267 	const unsigned char *d = d_orig;
1268 	unsigned int len, fullds;
1269 
1270 	if (!data || !data->priv || !d || !ds)
1271 		return;
1272 
1273 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1274 		  "Parsing %i byte(s) EXIF data...\n", ds);
1275 
1276 	/*
1277 	 * It can be that the data starts with the EXIF header. If it does
1278 	 * not, search the EXIF marker.
1279 	 */
1280 	if (ds < 6) {
1281 		LOG_TOO_SMALL;
1282 		return;
1283 	}
1284 	if (!memcmp (d, ExifHeader, 6)) {
1285 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1286 			  "Found EXIF header at start.");
1287 	} else {
1288 		while (ds >= 3) {
1289 			while (ds && (d[0] == 0xff)) {
1290 				d++;
1291 				ds--;
1292 			}
1293 
1294 			/* JPEG_MARKER_SOI */
1295 			if (ds && d[0] == JPEG_MARKER_SOI) {
1296 				d++;
1297 				ds--;
1298 				continue;
1299 			}
1300 
1301 			/* JPEG_MARKER_APP1 */
1302 			if (ds && d[0] == JPEG_MARKER_APP1) {
1303 				/*
1304 				 * Verify the exif header
1305 				 * (offset 3, length 6).
1306 				 * FF E1 NN NN EXIFHEADER
1307 				 *    ^^ d points here currently
1308 				 */
1309 				if ((ds >= 9) && !memcmp (d+3, ExifHeader, 6))
1310 					break;
1311 				/* fallthrough */
1312 			}
1313 			/* Skip irrelevant APP markers. The branch for APP1 must come before this,
1314 			   otherwise this code block will cause APP1 to be skipped. This code path
1315 			   is only relevant for files that are nonconformant to the EXIF
1316 			   specification. For conformant files, the APP1 code path above will be
1317 			   taken. */
1318 			if (ds >= 3 && d[0] >= 0xe0 && d[0] <= 0xef) {  /* JPEG_MARKER_APPn */
1319 				d++;
1320 				ds--;
1321 				l = (((unsigned int)d[0]) << 8) | d[1];
1322 				if (l > ds)
1323 					return;
1324 				d += l;
1325 				ds -= l;
1326 				continue;
1327 			}
1328 
1329 			/* Unknown marker or data. Give up. */
1330 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1331 				  "ExifData", _("EXIF marker not found."));
1332 			return;
1333 		}
1334 		if (ds < 3) {
1335 			LOG_TOO_SMALL;
1336 			return;
1337 		}
1338 		d++;
1339 		ds--;
1340 		len = (((unsigned int)d[0]) << 8) | d[1];
1341 		if (len > ds) {
1342 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1343 				  "ExifData", _("Read length %d is longer than data length %d."), len, ds);
1344 			return;
1345 		}
1346 		if (len < 2) {
1347 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1348 				  "ExifData", _("APP Tag too short."));
1349 			return;
1350 		}
1351 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1352 			  "We have to deal with %i byte(s) of EXIF data.",
1353 			  len);
1354 		d += 2;
1355 		ds = len - 2;	/* we do not want the full rest size, but only the size of the tag */
1356 	}
1357 
1358 	/*
1359 	 * Verify the exif header
1360 	 * (offset 2, length 6).
1361 	 */
1362 	if (ds < 6) {
1363 		LOG_TOO_SMALL;
1364 		return;
1365 	}
1366 	if (memcmp (d, ExifHeader, 6)) {
1367 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1368 			  "ExifData", _("EXIF header not found."));
1369 		return;
1370 	}
1371 
1372 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1373 		  "Found EXIF header.");
1374 
1375 	/* Sanity check the data length */
1376 	if (ds < 14)
1377 		return;
1378 
1379 	/* The JPEG APP1 section can be no longer than 64 KiB (including a
1380 	   16-bit length), so cap the data length to protect against overflow
1381 	   in future offset calculations */
1382 	fullds = ds;
1383 	if (ds > 0xfffe)
1384 		ds = 0xfffe;
1385 
1386 	/* Byte order (offset 6, length 2) */
1387 	if (!memcmp (d + 6, "II", 2))
1388 		data->priv->order = EXIF_BYTE_ORDER_INTEL;
1389 	else if (!memcmp (d + 6, "MM", 2))
1390 		data->priv->order = EXIF_BYTE_ORDER_MOTOROLA;
1391 	else {
1392 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1393 			  "ExifData", _("Unknown encoding."));
1394 		return;
1395 	}
1396 
1397 	/* Fixed value */
1398 	if (exif_get_short (d + 8, data->priv->order) != 0x002a)
1399 		return;
1400 
1401 	/* IFD 0 offset */
1402 	offset = exif_get_long (d + 10, data->priv->order);
1403 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1404 		  "IFD 0 at %i.", (int) offset);
1405 
1406 	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
1407 	if (offset > ds || offset + 6 + 2 > ds)
1408 		return;
1409 
1410 	/* Parse the actual exif data (usually offset 14 from start) */
1411 	exif_data_load_data_content (data, EXIF_IFD_0, d + 6, ds - 6, offset, 0);
1412 
1413 	/* IFD 1 offset */
1414 	n = exif_get_short (d + 6 + offset, data->priv->order);
1415 	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
1416 	if (offset + 6 + 2 + 12 * n + 4 > ds)
1417 		return;
1418 
1419 	offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
1420 	if (offset) {
1421 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1422 			  "IFD 1 at %i.", (int) offset);
1423 
1424 		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
1425 		if (offset > ds - 6) {
1426 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1427 				  "ExifData", "Bogus offset of IFD1.");
1428 		} else {
1429 			exif_data_load_data_content (data, EXIF_IFD_1, d + 6, ds - 6, offset, 0);
1430 		}
1431 	}
1432 
1433 	/*
1434 	 * If we got an EXIF_TAG_MAKER_NOTE, try to interpret it. Some
1435 	 * cameras use pointers in the maker note tag that point to the
1436 	 * space between IFDs. Here is the only place where we have access
1437 	 * to that data.
1438 	 */
1439 	interpret_maker_note(data, d, fullds);
1440 
1441 	/* Fixup tags if requested */
1442 	if (data->priv->options & EXIF_DATA_OPTION_FOLLOW_SPECIFICATION)
1443 		exif_data_fix (data);
1444 }
1445 
1446 void
exif_data_load_data_general(ExifData * data,const unsigned char * d_orig,unsigned int ds)1447 exif_data_load_data_general (ExifData* data, const unsigned char* d_orig,
1448 							 unsigned int ds)
1449 {
1450 	ExifLong offset;
1451 	ExifShort n;
1452 	const unsigned char* d = d_orig;
1453 	unsigned int fullds;
1454 
1455 	if (!data || !data->priv || !d || !ds)
1456 		return;
1457 
1458 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1459 		"Parsing %i byte(s) EXIF data...\n", ds);
1460 
1461 	/* Sanity check the data length */
1462 	if (ds < 14)
1463 		return;
1464 
1465 	/* The JPEG APP1 section can be no longer than 64 KiB (including a
1466 	   16-bit length), so cap the data length to protect against overflow
1467 	   in future offset calculations */
1468 	fullds = ds;
1469 	if (ds > 0xfffe)
1470 		ds = 0xfffe;
1471 
1472 	/* Byte order (offset 6, length 2) */
1473 	if (!memcmp(d + 6 - 6, "II", 2))
1474 		data->priv->order = EXIF_BYTE_ORDER_INTEL;
1475 	else if (!memcmp(d + 6 - 6, "MM", 2))
1476 		data->priv->order = EXIF_BYTE_ORDER_MOTOROLA;
1477 	else {
1478 		exif_log(data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1479 			"ExifData", _("Unknown encoding."));
1480 		return;
1481 	}
1482 
1483 	/* Fixed value */
1484 	if (exif_get_short(d + 8 - 6, data->priv->order) != 0x002a)
1485 		return;
1486 
1487 	/* IFD 0 offset */
1488 	offset = exif_get_long(d + 10 - 6, data->priv->order);
1489 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1490 		"IFD 0 at %i.", (int)offset);
1491 
1492 	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
1493 	// compare offset and buffer size
1494 	if (offset > ds || offset + 6 - 6 + 2 > ds)
1495 		return;
1496 
1497 	/* Parse the actual exif data (usually offset 14 from start) */
1498 	exif_data_load_data_content(data, EXIF_IFD_0, d + 6 - 6, ds - 6 + 6, offset, 0);
1499 
1500 	/* IFD 1 offset */
1501 	n = exif_get_short(d + 6 - 6 + offset, data->priv->order);
1502 	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
1503 	if (offset + 6 - 6 + 2 + 12 * n + 4 > ds)
1504 		return;
1505 
1506 	offset = exif_get_long(d + 6 - 6 + offset + 2 + 12 * n, data->priv->order);
1507 	if (offset) {
1508 		exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1509 			"IFD 1 at %i.", (int)offset);
1510 
1511 		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
1512 		if (offset > ds - 6 + 6) {
1513 			exif_log(data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1514 				"ExifData", "Bogus offset of IFD1.");
1515 		} else {
1516 			exif_data_load_data_content(data, EXIF_IFD_1, d + 6 - 6, ds - 6 + 6, offset, 0);
1517 		}
1518 	}
1519 
1520 	/*
1521 	 * If we got an EXIF_TAG_MAKER_NOTE, try to interpret it. Some
1522 	 * cameras use pointers in the maker note tag that point to the
1523 	 * space between IFDs. Here is the only place where we have access
1524 	 * to that data.
1525 	 */
1526 	interpret_maker_note(data, d, fullds);
1527 
1528 	/* Fixup tags if requested */
1529 	if (data->priv->options & EXIF_DATA_OPTION_FOLLOW_SPECIFICATION)
1530 		exif_data_fix(data);
1531 }
1532 
1533 void
exif_data_save_data(ExifData * data,unsigned char ** d,unsigned int * ds)1534 exif_data_save_data (ExifData *data, unsigned char **d, unsigned int *ds)
1535 {
1536 	if (ds)
1537 		*ds = 0;	/* This means something went wrong */
1538 
1539 	if (!data || !d || !ds)
1540 		return;
1541 
1542 	/* Header */
1543 	*ds = 14;
1544 	*d = exif_data_alloc (data, *ds);
1545 	if (!*d)  {
1546 		*ds = 0;
1547 		return;
1548 	}
1549 	memcpy (*d, ExifHeader, 6);
1550 
1551 	/* Order (offset 6) */
1552 	if (data->priv->order == EXIF_BYTE_ORDER_INTEL) {
1553 		memcpy (*d + 6, "II", 2);
1554 	} else {
1555 		memcpy (*d + 6, "MM", 2);
1556 	}
1557 
1558 	/* Fixed value (2 bytes, offset 8) */
1559 	exif_set_short (*d + 8, data->priv->order, 0x002a);
1560 
1561 	/*
1562 	 * IFD 0 offset (4 bytes, offset 10).
1563 	 * We will start 8 bytes after the
1564 	 * EXIF header (2 bytes for order, another 2 for the test, and
1565 	 * 4 bytes for the IFD 0 offset make 8 bytes together).
1566 	 */
1567 	exif_set_long (*d + 10, data->priv->order, 8);
1568 
1569 	/* Now save IFD 0. IFD 1 will be saved automatically. */
1570 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1571 		  "Saving IFDs...");
1572 	exif_data_save_data_content (data, data->ifd[EXIF_IFD_0], d, ds,
1573 				     *ds - 6);
1574 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1575 		  "Saved %i byte(s) EXIF data.", *ds);
1576 }
1577 
1578 void
exif_data_save_data_general(ExifData * data,unsigned char ** d,unsigned int * ds)1579 exif_data_save_data_general(ExifData* data, unsigned char** d, unsigned int* ds)
1580 {
1581 	if (ds)
1582 		*ds = 0;	/* This means something went wrong */
1583 
1584 	if (!data || !d || !ds)
1585 		return;
1586 
1587 	/* Header 4D 4D 00 2A 00 00 00 08*/
1588 	*ds = 8;
1589 	*d = exif_data_alloc(data, *ds);
1590 	if (!*d) {
1591 		*ds = 0;
1592 		return;
1593 	}
1594 
1595 	/* Order (offset 6) */
1596 	if (data->priv->order == EXIF_BYTE_ORDER_INTEL) {
1597 		memcpy(*d + 6 - 6, "II", 2);
1598 	}
1599 	else {
1600 		memcpy(*d + 6 - 6, "MM", 2);
1601 	}
1602 
1603 	/* Fixed value (2 bytes, offset 8) */
1604 	exif_set_short(*d + 8 - 6, data->priv->order, 0x002a);
1605 
1606 	/*
1607 	 * IFD 0 offset (4 bytes, offset 10).
1608 	 * We will start 8 bytes after the
1609 	 * EXIF header (2 bytes for order, another 2 for the test, and
1610 	 * 4 bytes for the IFD 0 offset make 8 bytes together).
1611 	 */
1612 	exif_set_long(*d + 10 - 6, data->priv->order, 8);
1613 	/* Now save IFD 0. IFD 1 will be saved automatically. */
1614 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1615 		"Saving IFDs...");
1616 	exif_data_save_data_content_general(data, data->ifd[EXIF_IFD_0], d, ds,
1617 		*ds);
1618 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1619 		"Saved %i byte(s) EXIF data.", *ds);
1620 }
1621 
1622 ExifData *
exif_data_new_from_file(const char * path)1623 exif_data_new_from_file (const char *path)
1624 {
1625 	ExifData *edata;
1626 	ExifLoader *loader;
1627 
1628 	loader = exif_loader_new ();
1629 	exif_loader_write_file (loader, path);
1630 	edata = exif_loader_get_data (loader);
1631 	exif_loader_unref (loader);
1632 
1633 	return (edata);
1634 }
1635 
1636 void
exif_data_ref(ExifData * data)1637 exif_data_ref (ExifData *data)
1638 {
1639 	if (!data)
1640 		return;
1641 
1642 	data->priv->ref_count++;
1643 }
1644 
1645 void
exif_data_unref(ExifData * data)1646 exif_data_unref (ExifData *data)
1647 {
1648 	if (!data || !data->priv)
1649 		return;
1650 
1651 	data->priv->ref_count--;
1652 	if (!data->priv->ref_count)
1653 		exif_data_free (data);
1654 }
1655 
1656 void
exif_data_free(ExifData * data)1657 exif_data_free (ExifData *data)
1658 {
1659 	unsigned int i;
1660 	ExifMem *mem = (data && data->priv) ? data->priv->mem : NULL;
1661 
1662 	if (!data)
1663 		return;
1664 
1665 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
1666 		if (data->ifd[i]) {
1667 			exif_content_unref (data->ifd[i]);
1668 			data->ifd[i] = NULL;
1669 		}
1670 	}
1671 
1672 	if (data->data) {
1673 		exif_mem_free (mem, data->data);
1674 		data->data = NULL;
1675 	}
1676 
1677 	if (data->priv) {
1678 		if (data->priv->log) {
1679 			exif_log_unref (data->priv->log);
1680 			data->priv->log = NULL;
1681 		}
1682 		if (data->priv->md) {
1683 			exif_mnote_data_unref (data->priv->md);
1684 			data->priv->md = NULL;
1685 		}
1686 		exif_mem_free (mem, data->priv);
1687 		exif_mem_free (mem, data);
1688 	}
1689 
1690 	exif_mem_unref (mem);
1691 }
1692 
1693 void
exif_data_dump(ExifData * data)1694 exif_data_dump (ExifData *data)
1695 {
1696 	unsigned int i;
1697 
1698 	if (!data)
1699 		return;
1700 
1701 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
1702 		if (data->ifd[i] && data->ifd[i]->count) {
1703 			printf ("Dumping IFD '%s'...\n",
1704 				exif_ifd_get_name (i));
1705 			exif_content_dump (data->ifd[i], 0);
1706 		}
1707 	}
1708 
1709 	if (data->data) {
1710 		printf ("%i byte(s) thumbnail data available: ", data->size);
1711 		if (data->size >= 4) {
1712 			printf ("0x%02x 0x%02x ... 0x%02x 0x%02x\n",
1713 				data->data[0], data->data[1],
1714 				data->data[data->size - 2],
1715 				data->data[data->size - 1]);
1716 		}
1717 	}
1718 }
1719 
1720 ExifByteOrder
exif_data_get_byte_order(ExifData * data)1721 exif_data_get_byte_order (ExifData *data)
1722 {
1723 	if (!data)
1724 		return (0);
1725 
1726 	return (data->priv->order);
1727 }
1728 
1729 void
exif_data_foreach_content(ExifData * data,ExifDataForeachContentFunc func,void * user_data)1730 exif_data_foreach_content (ExifData *data, ExifDataForeachContentFunc func,
1731 			   void *user_data)
1732 {
1733 	unsigned int i;
1734 
1735 	if (!data || !func)
1736 		return;
1737 
1738 	for (i = 0; i < EXIF_IFD_COUNT; i++)
1739 		func (data->ifd[i], user_data);
1740 }
1741 
1742 typedef struct _ByteOrderChangeData ByteOrderChangeData;
1743 struct _ByteOrderChangeData {
1744 	ExifByteOrder old, new;
1745 };
1746 
1747 static void
entry_set_byte_order(ExifEntry * e,void * data)1748 entry_set_byte_order (ExifEntry *e, void *data)
1749 {
1750 	ByteOrderChangeData *d = data;
1751 
1752 	if (!e)
1753 		return;
1754 
1755 	exif_array_set_byte_order (e->format, e->data, e->components, d->old, d->new);
1756 }
1757 
1758 static void
content_set_byte_order(ExifContent * content,void * data)1759 content_set_byte_order (ExifContent *content, void *data)
1760 {
1761 	exif_content_foreach_entry (content, entry_set_byte_order, data);
1762 }
1763 
1764 void
exif_data_set_byte_order(ExifData * data,ExifByteOrder order)1765 exif_data_set_byte_order (ExifData *data, ExifByteOrder order)
1766 {
1767 	ByteOrderChangeData d;
1768 
1769 	if (!data || (order == data->priv->order))
1770 		return;
1771 
1772 	d.old = data->priv->order;
1773 	d.new = order;
1774 	exif_data_foreach_content (data, content_set_byte_order, &d);
1775 	data->priv->order = order;
1776 	if (data->priv->md)
1777 		exif_mnote_data_set_byte_order (data->priv->md, order);
1778 }
1779 
1780 void
exif_data_log(ExifData * data,ExifLog * log)1781 exif_data_log (ExifData *data, ExifLog *log)
1782 {
1783 	unsigned int i;
1784 
1785 	if (!data || !data->priv)
1786 		return;
1787 	exif_log_unref (data->priv->log);
1788 	data->priv->log = log;
1789 	exif_log_ref (log);
1790 
1791 	for (i = 0; i < EXIF_IFD_COUNT; i++)
1792 		exif_content_log (data->ifd[i], log);
1793 }
1794 
1795 /* Used internally within libexif */
1796 ExifLog *exif_data_get_log (ExifData *);
1797 ExifLog *
exif_data_get_log(ExifData * data)1798 exif_data_get_log (ExifData *data)
1799 {
1800 	if (!data || !data->priv)
1801 		return NULL;
1802 	return data->priv->log;
1803 }
1804 
1805 static const struct {
1806 	ExifDataOption option;
1807 	const char *name;
1808 	const char *description;
1809 } exif_data_option[] = {
1810 	{EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS, N_("Ignore unknown tags"),
1811 	 N_("Ignore unknown tags when loading EXIF data.")},
1812 	{EXIF_DATA_OPTION_FOLLOW_SPECIFICATION, N_("Follow specification"),
1813 	 N_("Add, correct and remove entries to get EXIF data that follows "
1814 	    "the specification.")},
1815 	{EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE, N_("Do not change maker note"),
1816 	 N_("When loading and resaving Exif data, save the maker note unmodified."
1817 	    " Be aware that the maker note can get corrupted.")},
1818 	{0, NULL, NULL}
1819 };
1820 
1821 const char *
exif_data_option_get_name(ExifDataOption o)1822 exif_data_option_get_name (ExifDataOption o)
1823 {
1824 	unsigned int i;
1825 
1826 	for (i = 0; exif_data_option[i].name; i++)
1827 		if (exif_data_option[i].option == o)
1828 			break;
1829 	return _(exif_data_option[i].name);
1830 }
1831 
1832 const char *
exif_data_option_get_description(ExifDataOption o)1833 exif_data_option_get_description (ExifDataOption o)
1834 {
1835 	unsigned int i;
1836 
1837 	for (i = 0; exif_data_option[i].description; i++)
1838 		if (exif_data_option[i].option == o)
1839 			break;
1840 	return _(exif_data_option[i].description);
1841 }
1842 
1843 void
exif_data_set_option(ExifData * d,ExifDataOption o)1844 exif_data_set_option (ExifData *d, ExifDataOption o)
1845 {
1846 	if (!d)
1847 		return;
1848 
1849 	d->priv->options |= o;
1850 }
1851 
1852 void
exif_data_unset_option(ExifData * d,ExifDataOption o)1853 exif_data_unset_option (ExifData *d, ExifDataOption o)
1854 {
1855 	if (!d)
1856 		return;
1857 
1858 	d->priv->options &= ~o;
1859 }
1860 
1861 static void
fix_func(ExifContent * c,void * UNUSED (data))1862 fix_func (ExifContent *c, void *UNUSED(data))
1863 {
1864 	switch (exif_content_get_ifd (c)) {
1865 	case EXIF_IFD_1:
1866 		if (c->parent->data)
1867 			exif_content_fix (c);
1868 		else if (c->count) {
1869 			exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
1870 				  "No thumbnail but entries on thumbnail. These entries have been "
1871 				  "removed.");
1872 			while (c->count) {
1873 				unsigned int cnt = c->count;
1874 				exif_content_remove_entry (c, c->entries[c->count - 1]);
1875 				if (cnt == c->count) {
1876 					/* safety net */
1877 					exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
1878 					"failed to remove last entry from entries.");
1879 					c->count--;
1880 				}
1881 			}
1882 		}
1883 		break;
1884 	default:
1885 		exif_content_fix (c);
1886 	}
1887 }
1888 
1889 void
exif_data_fix(ExifData * d)1890 exif_data_fix (ExifData *d)
1891 {
1892 	exif_data_foreach_content (d, fix_func, NULL);
1893 }
1894 
1895 void
exif_data_set_data_type(ExifData * d,ExifDataType dt)1896 exif_data_set_data_type (ExifData *d, ExifDataType dt)
1897 {
1898 	if (!d || !d->priv)
1899 		return;
1900 
1901 	d->priv->data_type = dt;
1902 }
1903 
1904 ExifDataType
exif_data_get_data_type(ExifData * d)1905 exif_data_get_data_type (ExifData *d)
1906 {
1907 	return (d && d->priv) ? d->priv->data_type : EXIF_DATA_TYPE_UNKNOWN;
1908 }
1909 
exif_data_get_maker_note_entry_count(ExifData * data)1910 int exif_data_get_maker_note_entry_count(ExifData *data)
1911 {
1912 	int count = 0;
1913 	if (!data || !data->priv) {
1914 		return 0;
1915 	}
1916 	for (int i = 0; i < EXIF_IFD_COUNT; i++) {
1917 		if (!data->ifd[i]) {
1918 			continue;
1919 		}
1920 		for (int j = 0; j < data->ifd[i]->count; j++) {
1921 			ExifEntry *e = data->ifd[i]->entries[j];
1922 			if (e && e->tag == EXIF_TAG_MAKER_NOTE) {
1923 				count++;
1924 			}
1925 		}
1926 	}
1927 	return count;
1928 }