Regression test for https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36

tests/bugfixes/github/test_issue_ghsa_crmj_qh74_2r36.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+
+class QuickTimeVideoNikonTagsDecoderOutOfBoundsRead(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36
+    """
+    url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36"
+
+    filename = path("$data_path/issue_ghsa_crmj_qh74_2r36_poc.mov")
+    commands = ["$exiv2 $filename"]
+    retval = [1]
+    stderr   = ["""$exiv2_exception_message $filename:
+$kerCorruptedMetadata
+"""]
+    stdout = [""]

tests/regression_tests/test_regression_allfiles.py

@@ -113,6 +113,8 @@ def get_valid_files(data_dir):
         "issue_2339_poc.tiff",
         "issue_2352_poc.jpg",
         "issue_2385_poc.tiff",
+        "issue_ghsa_crmj_qh74_2r36_poc.mov",
+        "issue_ghsa_g9xm_7538_mq8w_poc.mov",
         "issue_ghsa_583f_w9pm_99r2_poc.jp2",
         "issue_ghsa_7569_phvm_vwc2_poc.jp2",
         "issue_ghsa_mxw9_qx4c_6m8v_poc.jp2",