Merge pull request #757 from Exiv2/fix_756_0.27

Fix #756 for 0.27

src/nikonmn_int.cpp

@@ -370,9 +370,13 @@ namespace Exiv2 {
                                                const ExifData*)
     {
         if (value.count() >= 1) {
-            unsigned long focusArea = value.toLong(0);
+            const unsigned long focusArea = value.toLong(0);
+            if (focusArea >= EXV_COUNTOF(nikonFocusarea)) {
+                os << "Invalid value";
+            } else {
                 os << nikonFocusarea[focusArea];
             }
+        }
         if (value.count() >= 2) {
             os << "; ";
             unsigned long focusPoint = value.toLong(1);

tests/bugfixes/github/test_issue_756.py

@@ -0,0 +1,20 @@
+import system_tests
+
+
+class BufferOverReadInNikon1MakerNotePrint0x0088(
+        metaclass=system_tests.CaseMeta):
+
+    url = "https://github.com/Exiv2/exiv2/issues/756"
+
+    filename = system_tests.path(
+        "$data_path/NikonMakerNotePrint0x088_overread"
+    )
+    commands = ["$exiv2 -pt --grep AFFocusPos $filename"]
+    stdout = [
+        """Exif.Nikon1.AFFocusPos                       Undefined   4  Invalid value; Center
+"""
+    ]
+    stderr = [""]
+    retval = [0]
+
+    compare_stderr = system_tests.check_no_ASAN_UBSAN_errors