From 74075d9b285446e2ae4ae1024653b96500b7dc68 Mon Sep 17 00:00:00 2001
From: Earl Ou <shunhsingou@google.com>
Date: Fri, 19 Oct 2012 18:30:01 +0800
Subject: Handle invalid data type in ExifParser

Change-Id: I547021c03ec9e5d53c7452926c2ca5b6bf11dc43
---
 gallerycommon/src/com/android/gallery3d/exif/ExifParser.java | 12 +++++++++++-
 gallerycommon/src/com/android/gallery3d/exif/ExifTag.java    |  7 +++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

(limited to 'gallerycommon')

diff --git a/gallerycommon/src/com/android/gallery3d/exif/ExifParser.java b/gallerycommon/src/com/android/gallery3d/exif/ExifParser.java
index 91fed9c76..b25cd2068 100644
--- a/gallerycommon/src/com/android/gallery3d/exif/ExifParser.java
+++ b/gallerycommon/src/com/android/gallery3d/exif/ExifParser.java
@@ -229,6 +229,9 @@ public class ExifParser {
         int endOfTags = mIfdStartOffset + OFFSET_SIZE + TAG_SIZE * mNumOfTagInIfd;
         if (offset < endOfTags) {
             mTag = readTag();
+            if (mTag == null) {
+                return next();
+            }
             if (mNeedToParseOffsetsInCurrentIfd) {
                 checkOffsetOrImageTag(mTag);
             }
@@ -305,8 +308,9 @@ public class ExifParser {
         if (mNeedToParseOffsetsInCurrentIfd) {
             while (offset < endOfTags) {
                 mTag = readTag();
-                checkOffsetOrImageTag(mTag);
                 offset += TAG_SIZE;
+                if (mTag == null) continue;
+                checkOffsetOrImageTag(mTag);
             }
         } else {
             skipTo(endOfTags);
@@ -470,6 +474,12 @@ public class ExifParser {
             throw new ExifInvalidFormatException(
                     "Number of component is larger then Integer.MAX_VALUE");
         }
+        // Some invalid image file contains invalid data type. Ignore those tags
+        if (!ExifTag.isValidType(dataFormat)) {
+            Log.w(TAG, String.format("Tag %04x: Invalid data type %d", tagId, dataFormat));
+            mTiffStream.skip(4);
+            return null;
+        }
         ExifTag tag = new ExifTag(tagId, dataFormat, (int) numOfComp, mIfdType);
         int dataSize = tag.getDataSize();
         if (dataSize > 4) {
diff --git a/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java b/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
index 37b6d9fd0..157a8db3b 100644
--- a/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
+++ b/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
@@ -913,6 +913,13 @@ public class ExifTag {
                 IfdId.TYPE_IFD_INTEROPERABILITY);
     }
 
+    static boolean isValidType(short type) {
+        return type == TYPE_UNSIGNED_BYTE || type == TYPE_ASCII ||
+               type == TYPE_UNSIGNED_SHORT || type == TYPE_UNSIGNED_LONG ||
+               type == TYPE_UNSIGNED_RATIONAL || type == TYPE_UNDEFINED ||
+               type == TYPE_LONG || type == TYPE_RATIONAL;
+    }
+
     ExifTag(short tagId, short type, int componentCount, int ifd) {
         mTagId = tagId;
         mDataType = type;
-- 
cgit v1.2.3