Re: CFD: eXIF 2017-0207

Tomorrow I'll update the eXIf proposal with this:

135c135,139
< This chunk does not introduce additional security issues.
---
> The Exif specification does not contain a requirement that
> tag "value offset" pointers actually point to a valid address
> within the file (see Paragraph 4.6.2).  Although this seems to be
> an implicit requrement, decoders should be prepared to encounter invalid
> pointers and deal with them appropriately.

On Sun, Feb 12, 2017 at 9:59 PM, John Bowler
<[email protected]> wrote:
> On Sun, Feb 12, 2017 at 6:16 PM, Glenn Randers-Pehrson
> <[email protected]> wrote:
>> This seems to be worth mentioning in the Security Considerations,
>> namely that decoders should be prepared to encounter tag offsets
>> that reference data outside the chunk data segment.
>
> Yes, I believe it is [...]

Glenn

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot