From 65a1fbe8ae1af569feeb69ad024a916d55345b24 Mon Sep 17 00:00:00 2001
From: 5225225 <5225225@mailbox.org>
Date: Sat, 29 May 2021 18:08:32 +0100
Subject: [PATCH] Test for short JPEG tag

---
 src/decoder/mod.rs     |  9 ++++++++-
 src/decoder/stream.rs  |  6 ++++++
 tests/decode_images.rs | 26 ++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs
index 61af67e..406d765 100644
--- a/src/decoder/mod.rs
+++ b/src/decoder/mod.rs
@@ -1409,7 +1409,14 @@ impl<R: Read + Seek> Decoder<R> {
 
         for (idx, offset) in offsets.iter().enumerate() {
             self.goto_offset(*offset)?;
-            let jpeg_reader = JpegReader::new(&mut self.reader, bytes[idx], &jpeg_tables)?;
+            let length = bytes[idx];
+
+            if jpeg_tables.is_some() && length < 2 {
+                return Err(TiffError::FormatError(
+                    TiffFormatError::InvalidTagValueType(Tag::JPEGTables),
+                ));
+            }
+            let jpeg_reader = JpegReader::new(&mut self.reader, length, &jpeg_tables)?;
             let mut decoder = jpeg::Decoder::new(jpeg_reader);
 
             match decoder.decode() {
diff --git a/src/decoder/stream.rs b/src/decoder/stream.rs
index c73e08c..c1c990d 100644
--- a/src/decoder/stream.rs
+++ b/src/decoder/stream.rs
@@ -231,6 +231,12 @@ impl JpegReader {
                     tables
                 );
 
+                assert!(
+                    length >= 2,
+                    "if jpeg_tables is given, length must be at least 2 bytes long, got {}",
+                    length
+                );
+
                 let mut jpeg_data = tables.clone();
                 let truncated_length = jpeg_data.len() - 2;
                 jpeg_data.truncate(truncated_length);
diff --git a/tests/decode_images.rs b/tests/decode_images.rs
index e13273b..2bc8851 100644
--- a/tests/decode_images.rs
+++ b/tests/decode_images.rs
@@ -449,3 +449,29 @@ fn invalid_jpeg_tag() {
         unexpected => panic!("Unexpected error {}", unexpected),
     }
 }
+
+#[test]
+fn invalid_jpeg_tag_2() {
+    use tiff::tags;
+    use tiff::{TiffError, TiffFormatError};
+
+    let image = [
+        73, 73, 42, 0, 8, 0, 0, 0, 16, 0, 254, 0, 4, 0, 1, 0, 0, 0, 0, 0, 0, 242, 0, 1, 4, 0, 1, 0,
+        0, 0, 0, 129, 16, 0, 1, 1, 4, 0, 1, 0, 0, 0, 214, 0, 0, 248, 253, 1, 3, 0, 1, 0, 0, 0, 64,
+        0, 0, 0, 3, 1, 3, 0, 1, 0, 0, 0, 7, 0, 0, 0, 6, 1, 3, 0, 1, 0, 0, 0, 1, 0, 0, 64, 14, 1, 0,
+        2, 0, 0, 148, 0, 206, 0, 0, 0, 17, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0,
+        1, 0, 0, 0, 22, 1, 4, 0, 17, 0, 0, 201, 1, 0, 0, 0, 23, 1, 2, 0, 20, 0, 0, 0, 194, 0, 0, 0,
+        91, 1, 7, 0, 5, 0, 0, 0, 64, 0, 0, 0, 237, 254, 65, 255, 255, 255, 255, 255, 1, 0, 0, 0,
+        22, 1, 4, 0, 1, 0, 0, 0, 42, 0, 0, 0, 23, 1, 255, 255, 255, 255, 255, 36, 36, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 36, 73, 73, 0, 42, 36, 36, 36, 36, 0, 0, 8, 0,
+    ];
+
+    let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap();
+
+    let err = decoder.read_image().unwrap_err();
+
+    match err {
+        TiffError::FormatError(TiffFormatError::InvalidTagValueType(tags::Tag::JPEGTables)) => {}
+        unexpected => panic!("Unexpected error {}", unexpected),
+    }
+}