From 0603afda32003d603458c61c10352c80a019f3d6 Mon Sep 17 00:00:00 2001
From: Tee KOBAYASHI <xtkoba@gmail.com>
Date: Sat, 5 Nov 2022 10:50:05 +0900
Subject: [PATCH] jhead: Add patch for CVE-2021-34055

---
 packages/jhead/CVE-2021-34055.patch | 109 ++++++++++++++++++++++++++++
 packages/jhead/build.sh             |   1 +
 2 files changed, 110 insertions(+)
 create mode 100644 packages/jhead/CVE-2021-34055.patch

diff --git a/packages/jhead/CVE-2021-34055.patch b/packages/jhead/CVE-2021-34055.patch
new file mode 100644
index 0000000000..69c7bbe2d1
--- /dev/null
+++ b/packages/jhead/CVE-2021-34055.patch
@@ -0,0 +1,109 @@
+https://github.com/Matthias-Wandel/jhead/commit/f0a884210cc46830b176f71fd61569adc8f230a7
+
+Diff for makefile is deleted as it seems to be irrelevant.
+
+From c761620767ae72e5d61c697a73de262aebe0b591 Mon Sep 17 00:00:00 2001
+From: matthias wandel <matthias@woodgears.ca>
+Date: Wed, 1 Sep 2021 18:59:15 -0300
+Subject: [PATCH] If exif header is complete garbage, don't keep it.  Fixes
+ issue 36
+
+---
+ exif.c    | 12 +++++++-----
+ jhead.h   |  2 +-
+ jpgfile.c |  5 ++++-
+ makefile  |  8 +++++---
+ 4 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/exif.c b/exif.c
+index f805b8f..2057acd 100644
+--- a/exif.c
++++ b/exif.c
+@@ -1005,7 +1005,7 @@ void Clear_EXIF ()
+ // Process a EXIF marker
+ // Describes all the drivel that most digital cameras include...
+ //--------------------------------------------------------------------------
+-void process_EXIF (unsigned char * ExifSection, int length)
++int process_EXIF (unsigned char * ExifSection, int length)
+ {
+     int FirstOffset;
+ 
+@@ -1020,7 +1020,7 @@ void process_EXIF (unsigned char * ExifSection, int length)
+         static uchar ExifHeader[] = "Exif\0\0";
+         if (memcmp(ExifSection+2, ExifHeader,6)){
+             ErrNonfatal("Incorrect Exif header",0,0);
+-            return;
++            return 0;
+         }
+     }
+ 
+@@ -1033,21 +1033,21 @@ void process_EXIF (unsigned char * ExifSection, int length)
+             MotorolaOrder = 1;
+         }else{
+             ErrNonfatal("Invalid Exif alignment marker.",0,0);
+-            return;
++            return 0;
+         }
+     }
+ 
+     // Check the next value for correctness.
+     if (Get16u(ExifSection+10) != 0x2a){
+         ErrNonfatal("Invalid Exif start (1)",0,0);
+-        return;
++        return 0;
+     }
+ 
+     FirstOffset = (int)Get32u(ExifSection+12);
+     if (FirstOffset < 8 || FirstOffset > 16){
+         if (FirstOffset < 16 || FirstOffset > length-16 || length < 16){
+             ErrNonfatal("invalid offset for first Exif IFD value",0,0);
+-            return;
++            return 0;
+         }
+         // Usually set to 8, but other values valid too.
+         ErrNonfatal("Suspicious offset of first Exif IFD value",0,0);
+@@ -1087,6 +1087,7 @@ void process_EXIF (unsigned char * ExifSection, int length)
+             ImageInfo.FocalLength35mmEquiv = (int)(ImageInfo.FocalLength/ImageInfo.CCDWidth*36 + 0.5);
+         }
+     }
++	return 1;
+ }
+ 
+ 
+@@ -1236,6 +1237,7 @@ void create_EXIF(void)
+ const char * ClearOrientation(void)
+ {
+     int a;
++
+     if (NumOrientations == 0) return NULL;
+ 
+     for (a=0;a<NumOrientations;a++){
+diff --git a/jhead.h b/jhead.h
+index c39da7f..67626ec 100644
+--- a/jhead.h
++++ b/jhead.h
+@@ -163,7 +163,7 @@ void FileTimeAsString(char * TimeStr);
+ // Prototypes for exif.c functions.
+ int Exif2tm(struct tm * timeptr, char * ExifTime);
+ void Clear_EXIF();
+-void process_EXIF (unsigned char * CharBuf, int length);
++int process_EXIF (unsigned char * CharBuf, int length);
+ void ShowImageInfo(int ShowFileInfo);
+ void ShowConciseImageInfo(void);
+ const char * ClearOrientation(void);
+diff --git a/jpgfile.c b/jpgfile.c
+index dc84838..64be42b 100644
+--- a/jpgfile.c
++++ b/jpgfile.c
+@@ -286,7 +286,10 @@ int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)
+                 // There can be different section using the same marker.
+                 if (ReadMode & READ_METADATA){
+                     if (memcmp(Data+2, "Exif", 4) == 0){
+-                        process_EXIF(Data, itemlen);
++                        if (!process_EXIF(Data, itemlen)){
++                            // malformatted exif sections, discard.
++                            free(Sections[--SectionsRead].Data);
++						}
+                         break;
+                     }else if (memcmp(Data+2, "http:", 5) == 0){
+                         Sections[SectionsRead-1].Type = M_XMP; // Change tag for internal purposes.
diff --git a/packages/jhead/build.sh b/packages/jhead/build.sh
index 1ae63fddef..276e844329 100644
--- a/packages/jhead/build.sh
+++ b/packages/jhead/build.sh
@@ -3,6 +3,7 @@ TERMUX_PKG_DESCRIPTION="Exif Jpeg header manipulation tool"
 TERMUX_PKG_LICENSE="Public Domain"
 TERMUX_PKG_MAINTAINER="@termux"
 TERMUX_PKG_VERSION=3.06.0.1
+TERMUX_PKG_REVISION=1
 TERMUX_PKG_SRCURL=https://github.com/Matthias-Wandel/jhead/archive/refs/tags/${TERMUX_PKG_VERSION}.tar.gz
 TERMUX_PKG_SHA256=5c5258c3d7a840bf831e22174e4a24cb1de3baf442f7cb73d5ab31b4ae0b0058
 TERMUX_PKG_AUTO_UPDATE=true