1
SUBDIRS = m4m po libexif test doc binary
2
SUBDIRS = m4m po libexif test binary

1
#!/usr/bin/env python3
2

3
import struct
4
import os
5

6
def pack_data(fmt, endian, *args):
7
    return struct.pack(('<' if endian == 'LE' else '>') + fmt, *args)
8

9
class ExifGenerator:
10
    def __init__(self, endian='LE'):
11
        self.endian = endian
12
        self.entries = []
13
        self.data_blobs = b''
14

15
    def add_entry(self, tag, data_type, count, value):
16
        self.entries.append({'tag': tag, 'type': data_type, 'count': count, 'value': value})
17

18
    def build_ifd(self, start_offset, next_ifd_offset=0):
19
        ifd_data = pack_data('H', self.endian, len(self.entries))
20
        data_offset = start_offset + 2 + (len(self.entries) * 12) + 4
21

22
        entry_bytes = b''
23
        blob_bytes = b''
24

25
        for e in self.entries:
26
            val_bytes = b''
27
            raw_blob = None
28

29
            if e['type'] == 1: # BYTE
30
                if isinstance(e['value'], int): raw_blob = pack_data('B', self.endian, e['value'])
31
                else: raw_blob = e['value']
32
            elif e['type'] == 2: # ASCII
33
                raw_blob = e['value'].encode('ascii') + b'\x00'
34
            elif e['type'] == 3: # SHORT
35
                if e['count'] == 1: raw_blob = pack_data('H', self.endian, e['value'])
36
                else: raw_blob = pack_data('H'*e['count'], self.endian, *e['value'])
37
            elif e['type'] == 4: # LONG
38
                if e['count'] == 1: raw_blob = pack_data('I', self.endian, e['value'])
39
                else: raw_blob = pack_data('I'*e['count'], self.endian, *e['value'])
40
            elif e['type'] == 5: # RATIONAL
41
                raw_blob = pack_data('II', self.endian, e['value'][0], e['value'][1])
42
            elif e['type'] == 7: # UNDEFINED
43
                raw_blob = e['value']
44
            elif e['type'] == 10: # SRATIONAL
45
                raw_blob = pack_data('ii', self.endian, e['value'][0], e['value'][1])
46

47
            if len(raw_blob) <= 4:
48
                val_bytes = raw_blob.ljust(4, b'\x00')
49
            else:
50
                off = data_offset + len(blob_bytes)
51
                val_bytes = pack_data('I', self.endian, off)
52
                blob_bytes += raw_blob
53

54
            entry_bytes += pack_data('HHII', self.endian, e['tag'], e['type'], e['count'], struct.unpack('<I' if self.endian == 'LE' else '>I', val_bytes)[0])
55

56
        return ifd_data + entry_bytes + pack_data('I', self.endian, next_ifd_offset) + blob_bytes
57

58
def create_complex_exif(endian='LE'):
59
    # 1. Build Exif SubIFD
60
    exif = ExifGenerator(endian)
61
    exif.add_entry(0x9003, 2, 20, "2026:02:24 14:00:00")
62
    exif.add_entry(0x829a, 5, 1, (1, 100))
63
    exif.add_entry(0x829d, 5, 1, (28, 10))
64
    exif.add_entry(0x9204, 10, 1, (-1, 3))
65
    exif.add_entry(0x9286, 7, 8, b"USERCOM\x00")
66
    exif_sub_data = exif.build_ifd(0) # Length check only first
67

68
    # 2. Build GPS IFD
69
    gps = ExifGenerator(endian)
70
    gps.add_entry(0x0000, 1, 4, b'\x02\x02\x00\x00')
71
    gps.add_entry(0x0002, 5, 3, (1, 1)) # This will actually need 3 rationals, but let's keep it simple
72
    # Fix: GPS Latitude is 3 rationals
73
    gps.entries[-1] = {'tag': 0x0002, 'type': 5, 'count': 3, 'value': (40, 1, 30, 1, 15, 1)}
74
    gps_data = gps.build_ifd(0)
75

76
    # 3. Build IFD0
77
    ifd0 = ExifGenerator(endian)
78
    ifd0.add_entry(0x010e, 2, 11, "Fuzz Test")
79
    ifd0.add_entry(0x0110, 2, 11, "Gemini Cam")
80
    ifd0.add_entry(0x8769, 4, 1, 0) # ExifOffset
81
    ifd0.add_entry(0x8825, 4, 1, 0) # GPSInfo
82

83
    # IFD0 fixed size: 2 + 4*12 + 4 = 54. Blobs: 11 + 11 = 22. Total = 76.
84
    ifd0_total_len = 76
85
    exif_offset = 8 + ifd0_total_len
86
    gps_offset = exif_offset + len(exif_sub_data)
87

88
    for e in ifd0.entries:
89
        if e['tag'] == 0x8769: e['value'] = exif_offset
90
        if e['tag'] == 0x8825: e['value'] = gps_offset
91

92
    final_ifd0 = ifd0.build_ifd(8)
93
    final_exif = exif.build_ifd(exif_offset)
94
    final_gps = gps.build_ifd(gps_offset)
95

96
    header = b'II\x2a\x00\x08\x00\x00\x00' if endian == 'LE' else b'MM\x00\x2a\x00\x00\x00\x08'
97
    return header + final_ifd0 + final_exif + final_gps
98

99
def save_corpus(name, data, add_exif_header=False):
100
    os.makedirs('corpus/exif', exist_ok=True)
101
    with open(os.path.join('corpus/exif', name), 'wb') as f:
102
        if add_exif_header: f.write(b'Exif\x00\x00')
103
        f.write(data)
104
    print(f"Created {name}")
105

106
if __name__ == "__main__":
107
    save_corpus('rich_le.exif', create_complex_exif('LE'), True)
108
    save_corpus('rich_be.exif', create_complex_exif('BE'), True)
109

110
    SOI, APP1 = b'\xff\xd8', b'\xff\xe1'
111
    exif_payload = b'Exif\x00\x00' + create_complex_exif('LE')
112
    app1_data = APP1 + struct.pack('>H', len(exif_payload) + 2) + exif_payload
113
    save_corpus('rich_jpeg.jpg', SOI + app1_data + b'\xff\xd9')
114
    save_corpus('raw_tiff.exif', create_complex_exif('LE'), False)

1
case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
2
  o = exif_get_long(d + offset + 12 * i + 8, data->priv->order);
3
   if (o >= ds) {
4
     exif_log(data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
5
              "Illegal offset value detected!");
6
     abort();
7
  }

1
case EXIF_TAG_SHARPNESS:
2
  switch (e->format) {
3
  case EXIF_FORMAT_LONG:
4
    if (!e->parent || !e->parent->parent)
5
      break;
6
     if (e->components <= 0 || e->components > 65535) {
7
       exif_entry_log(e, EXIF_LOG_CODE_CORRUPT_DATA,
8
                      "Component size is too large!");
9
       abort();
10
     }
11
     if (e->size < e->components * exif_format_get_size(EXIF_FORMAT_LONG)) {
12
       exif_entry_log(e, EXIF_LOG_CODE_CORRUPT_DATA,
13
                      "Corrupted data size detected!");
14
       abort();
15
     };
16
    o = exif_data_get_byte_order(e->parent->parent);
17
    for (i = 0; i < e->components; i++)
18
      exif_set_short(
19
          e->data + i * exif_format_get_size(EXIF_FORMAT_SHORT), o,
20
          (ExifShort)exif_get_long(
21
              e->data + i * exif_format_get_size(EXIF_FORMAT_LONG), o));
22
    e->format = EXIF_FORMAT_SHORT;
23
    e->size = e->components * exif_format_get_size(e->format);
24
    e->data = exif_entry_realloc(e, e->data, e->size);
25
    exif_entry_log(e, EXIF_LOG_CODE_DEBUG,
26
                   _("Tag '%s' was of format '%s' (which is "
27
                     "against specification) and has been "
28
                     "changed to format '%s'."),
29
                   exif_tag_get_name(e->tag),
30
                   exif_format_get_name(EXIF_FORMAT_LONG),
31
                   exif_format_get_name(EXIF_FORMAT_SHORT));
32
    break;