In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash.
cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*
4A0D0423-EA55-4C2F-8CC8-25E5B9F875A6
0.27.2
OR
**Describe the bug**
I found a buffer overflow bugs in exiv2/src/webpimage.cpp:837 due to integer overflow.
**To Reproduce**
Steps to reproduce the behaviour:
exiv2/build/bin/exiv2 exiv2_getHeaderOffset.poc

**Expected behavior**
In Exiv2::WebPImage::getHeaderOffset, integer overflow occurs when data_size is less than header_size, and it will cause buffer overflow in '&data[i]'.
![image](https://user-images.githubusercontent.com/17027039/61193458-0eaa9b80-a6ee-11e9-9a28-b2da63458ad8.png)
```
#0  0x00007ffff784ce88 in Exiv2::WebPImage::getHeaderOffset (this=<optimized out>, data=0x71a2e0 "\300\\\310\366\377\177", data_size=0x0, header_size=0x4, header=<optimized out>) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:837
#1  Exiv2::WebPImage::decodeChunks (this=<optimized out>, filesize=<optimized out>) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:632
#2  0x00007ffff784b2e0 in Exiv2::WebPImage::readMetadata (this=0x719820) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:508
#3  0x000000000049d59d in Action::Print::printSummary (this=0x71a950) at /data/Exiv2_AFL/exiv2/src/actions.cpp:260
#4  0x000000000049cf30 in Action::Print::run (this=0x71a950, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
path=) at /data/Exiv2_AFL/exiv2/src/actions.cpp:215
#5  0x00000000004094e6 in main (argc=<optimized out>, argc@entry=0x2, argv=<optimized out>, argv@entry=0x7fffffffe6c8) at /data/Exiv2_AFL/exiv2/src/exiv2.cpp:77
#6  0x00007ffff68bbb97 in __libc_start_main (main=0x408b30 <main(int, char* const*)>, argc=0x2, argv=0x7fffffffe6c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe6b8) at ../csu/libc-start.c:310
#7  0x0000000000408a6a in _start ()

   0x7ffff784ce77 <Exiv2::WebPImage::decodeChunks(long)+4279>:	mov    rcx,QWORD PTR [rsp+0x8]
   0x7ffff784ce7c <Exiv2::WebPImage::decodeChunks(long)+4284>:	mov    rdx,QWORD PTR [rsp]
   0x7ffff784ce80 <Exiv2::WebPImage::decodeChunks(long)+4288>:	lea    rsp,[rsp+0x98]
=> 0x7ffff784ce88 <Exiv2::WebPImage::decodeChunks(long)+4296>:	cmp    DWORD PTR [rcx+rsi*1],0xe1ff01ff
   0x7ffff784ce8f <Exiv2::WebPImage::decodeChunks(long)+4303>:	je     0x7ffff784d858 <Exiv2::WebPImage::decodeChunks(long)+6808>
   0x7ffff784ce95 <Exiv2::WebPImage::decodeChunks(long)+4309>:	nop    DWORD PTR [rax]
   0x7ffff784ce98 <Exiv2::WebPImage::decodeChunks(long)+4312>:	lea    rsp,[rsp-0x98]
   0x7ffff784cea0 <Exiv2::WebPImage::decodeChunks(long)+4320>:	mov    QWORD PTR [rsp],rdx


RCX: 0x71a2e0
RSI: 0xdd1d

```
The poc is here:
Just do 'exiv2/build/bin/exiv2 exiv2_getHeaderOffset.poc'

[exiv2_getHeaderOffset.poc.zip](https://github.com/Exiv2/exiv2/files/3390730/exiv2_getHeaderOffset.poc.zip)



buffer overflow in exiv2/src/webpimage.cpp
This is a GitHub Issue
repo:exiv2
owner:Exiv2
Title : buffer overflow in exiv2/src/webpimage.cpp
Issue date:

--- start body ---
**Describe the bug**
I found a buffer overflow bugs in exiv2/src/webpimage.cpp:837 due to integer overflow.
**To Reproduce**
Steps to reproduce the behaviour:
exiv2/build/bin/exiv2 exiv2_getHeaderOffset.poc

**Expected behavior**
In Exiv2::WebPImage::getHeaderOffset, integer overflow occurs when data_size is less than header_size, and it will cause buffer overflow in '&data[i]'.
![image](https://user-images.githubusercontent.com/17027039/61193458-0eaa9b80-a6ee-11e9-9a28-b2da63458ad8.png)
```
#0  0x00007ffff784ce88 in Exiv2::WebPImage::getHeaderOffset (this=<optimized out>, data=0x71a2e0 "\300\\\310\366\377\177", data_size=0x0, header_size=0x4, header=<optimized out>) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:837
#1  Exiv2::WebPImage::decodeChunks (this=<optimized out>, filesize=<optimized out>) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:632
#2  0x00007ffff784b2e0 in Exiv2::WebPImage::readMetadata (this=0x719820) at /data/Exiv2_AFL/exiv2/src/webpimage.cpp:508
#3  0x000000000049d59d in Action::Print::printSummary (this=0x71a950) at /data/Exiv2_AFL/exiv2/src/actions.cpp:260
#4  0x000000000049cf30 in Action::Print::run (this=0x71a950, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
path=) at /data/Exiv2_AFL/exiv2/src/actions.cpp:215
#5  0x00000000004094e6 in main (argc=<optimized out>, argc@entry=0x2, argv=<optimized out>, argv@entry=0x7fffffffe6c8) at /data/Exiv2_AFL/exiv2/src/exiv2.cpp:77
#6  0x00007ffff68bbb97 in __libc_start_main (main=0x408b30 <main(int, char* const*)>, argc=0x2, argv=0x7fffffffe6c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe6b8) at ../csu/libc-start.c:310
#7  0x0000000000408a6a in _start ()

   0x7ffff784ce77 <Exiv2::WebPImage::decodeChunks(long)+4279>:	mov    rcx,QWORD PTR [rsp+0x8]
   0x7ffff784ce7c <Exiv2::WebPImage::decodeChunks(long)+4284>:	mov    rdx,QWORD PTR [rsp]
   0x7ffff784ce80 <Exiv2::WebPImage::decodeChunks(long)+4288>:	lea    rsp,[rsp+0x98]
=> 0x7ffff784ce88 <Exiv2::WebPImage::decodeChunks(long)+4296>:	cmp    DWORD PTR [rcx+rsi*1],0xe1ff01ff
   0x7ffff784ce8f <Exiv2::WebPImage::decodeChunks(long)+4303>:	je     0x7ffff784d858 <Exiv2::WebPImage::decodeChunks(long)+6808>
   0x7ffff784ce95 <Exiv2::WebPImage::decodeChunks(long)+4309>:	nop    DWORD PTR [rax]
   0x7ffff784ce98 <Exiv2::WebPImage::decodeChunks(long)+4312>:	lea    rsp,[rsp-0x98]
   0x7ffff784cea0 <Exiv2::WebPImage::decodeChunks(long)+4320>:	mov    QWORD PTR [rsp],rdx


RCX: 0x71a2e0
RSI: 0xdd1d

```
The poc is here:
Just do 'exiv2/build/bin/exiv2 exiv2_getHeaderOffset.poc'

[exiv2_getHeaderOffset.poc.zip](https://github.com/Exiv2/exiv2/files/3390730/exiv2_getHeaderOffset.poc.zip)



--- end body ---

comments :
--- start comments ---

--- end comments ---