A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).
cpe:2.3:a:exiv2:exiv2:0.27.1:*:*:*:*:*:*:*
9E196C7D-A075-43E0-A620-C2D7C0EB559F
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
There is a buffer overflow in exiv2 in file types.cpp.

Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

The compile command is:
cmake ./ ;make

To reproduce the issue, run:
./exiv2 input

Here is the trace reported by asan:

#0 0x7faff55ba631  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
    #1 0x7faff55bf5e3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa55e3)
    #2 0x7faff5537425  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x1d425)
    #3 0x7faff55bd865  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa3865)
    #4 0x7faff553cb4d  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22b4d)
    #5 0x7faff55b367e in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9967e)
    #6 0x7faff0f63d25 in Exiv2::DataBuf::DataBuf(long) /home/heqing/playground/exiv2-0.27.1-Source-a/src/types.cpp:141
    #7 0x7faff0dc8995 in Exiv2::RafImage::readMetadata() /home/heqing/playground/exiv2-0.27.1-Source-a/src/rafimage.cpp:300
    #8 0x77b36d in Action::Print::printSummary() /home/heqing/playground/exiv2-0.27.1-Source-a/src/actions.cpp:286
    #9 0x79935f in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/heqing/playground/exiv2-0.27.1-Source-a/src/actions.cpp:246
    #10 0x410f18 in main /home/heqing/playground/exiv2-0.27.1-Source-a/src/exiv2.cpp:169
    #11 0x7fafecfe282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x41abb8 in _start (/home/heqing/playground/exiv2-0.27.1-Source-a/build/bin/exiv2+0x41abb8)

The reason is that DataBuf in types.cpp does not check the malloced buffer is a null pointer or not yet directly use memcpy to write the buffer.
![image](https://user-images.githubusercontent.com/7632714/62766397-f8adb200-bac4-11e9-9e03-ba121760f6bc.png)

The attachment is the poc input.
[poc_input2.zip](https://github.com/Exiv2/exiv2/files/3485483/poc_input2.zip)

Buffer overflow caused by exhaustive memory usage 
This is a GitHub Issue
repo:exiv2
owner:Exiv2
Title : Buffer overflow caused by exhaustive memory usage 
Issue date:

--- start body ---
There is a buffer overflow in exiv2 in file types.cpp.

Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

The compile command is:
cmake ./ ;make

To reproduce the issue, run:
./exiv2 input

Here is the trace reported by asan:

#0 0x7faff55ba631  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
    #1 0x7faff55bf5e3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa55e3)
    #2 0x7faff5537425  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x1d425)
    #3 0x7faff55bd865  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa3865)
    #4 0x7faff553cb4d  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22b4d)
    #5 0x7faff55b367e in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9967e)
    #6 0x7faff0f63d25 in Exiv2::DataBuf::DataBuf(long) /home/heqing/playground/exiv2-0.27.1-Source-a/src/types.cpp:141
    #7 0x7faff0dc8995 in Exiv2::RafImage::readMetadata() /home/heqing/playground/exiv2-0.27.1-Source-a/src/rafimage.cpp:300
    #8 0x77b36d in Action::Print::printSummary() /home/heqing/playground/exiv2-0.27.1-Source-a/src/actions.cpp:286
    #9 0x79935f in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/heqing/playground/exiv2-0.27.1-Source-a/src/actions.cpp:246
    #10 0x410f18 in main /home/heqing/playground/exiv2-0.27.1-Source-a/src/exiv2.cpp:169
    #11 0x7fafecfe282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x41abb8 in _start (/home/heqing/playground/exiv2-0.27.1-Source-a/build/bin/exiv2+0x41abb8)

The reason is that DataBuf in types.cpp does not check the malloced buffer is a null pointer or not yet directly use memcpy to write the buffer.
![image](https://user-images.githubusercontent.com/7632714/62766397-f8adb200-bac4-11e9-9e03-ba121760f6bc.png)

The attachment is the poc input.
[poc_input2.zip](https://github.com/Exiv2/exiv2/files/3485483/poc_input2.zip)

--- end body ---

comments :
--- start comments ---

--- end comments ---