Merge pull request #217 from D4N/fix_187

Fix for #187

src/pngchunk_int.cpp

@@ -103,15 +103,17 @@ namespace Exiv2 {
     {
         // From a tEXt, zTXt, or iTXt chunk,
         // we get the key, it's a null terminated string at the chunk start
-        if (data.size_ <= (stripHeader ? 8 : 0)) throw Error(14);
+        const int offset = stripHeader ? 8 : 0;
-        const byte *key = data.pData_ + (stripHeader ? 8 : 0);
+        if (data.size_ <= offset) throw Error(14);
+        const byte *key = data.pData_ + offset;
 
         // Find null string at end of key.
         int keysize=0;
-        for ( ; key[keysize] != 0 ; keysize++)
+        while (key[keysize] != 0)
         {
+            keysize++;
             // look if keysize is valid.
-            if (keysize >= data.size_)
+            if (keysize+offset >= data.size_)
                 throw Error(14);
         }
 

tests/bugfixes/github/test_CVE_2017_17669.py

@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class RunPocFile(system_tests.Case):
+
+    filename = "{data_path}/issue_187"
+    commands = ["{exiv2} " + filename]
+    retval = [1]
+    stdout = [""]
+    stderr = [
+	"""{exiv2_exception_msg} """ + filename + """:
+{error_14_message}
+"""
+    ]

tests/suite.conf

@@ -15,6 +15,7 @@ data_path: ../test/data
 tiff-test: ${ENV:exiv2_path}/tiff-test${ENV:binary_extension}
 
 [variables]
+error_14_message: Failed to read image data
 error_58_message: corrupted image metadata
 error_57_message: invalid memory allocation request
 exiv2_exception_msg: Exiv2 exception in print action for file