CVE-2020-13113: Use of Uninitialized Resource (CWE-908)
value: An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 8.2
Published: 2020-05-21T17:15Z
Repository: https://github.com/libexif/libexif
Language: C
Files changed: libexif/canon/exif-mnote-data-canon.c, libexif/fuji/exif-mnote-data-fuji.c, libexif/olympus/exif-mnote-data-olympus.c, libexif/pentax/exif-mnote-data-pentax.c
Commit date: 2020-05-16 19:29:21 +0200
Commit message: Ensure the MakerNote data pointers are initialized with NULL.

This ensures that an uninitialized pointer isn't dereferenced later in
the case where the number of components (and therefore size) is 0.

This fixes the second issue reported at
https://sourceforge.net/p/libexif/bugs/125/

CVE-2020-13113

Diff: diff --git a/libexif/canon/exif-mnote-data-canon.c b/libexif/canon/exif-mnote-data-canon.c
index 4e993251..b8a21e16 100644
--- a/libexif/canon/exif-mnote-data-canon.c
+++ b/libexif/canon/exif-mnote-data-canon.c
@@ -234,10 +234,11 @@ exif_mnote_data_canon_load (ExifMnoteData *ne,
 	/* Parse the entries */
 	tcount = 0;
 	for (i = c, o = datao; i; --i, o += 12) {
 		size_t s;
 
+		memset(&n->entries[tcount], 0, sizeof(MnoteCanonEntry));
 		if (CHECKOVERFLOW(o,buf_size,12)) {
 			exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
 				"ExifMnoteCanon", "Short MakerNote");
 			break;
 		}
diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
index 6671e4cd..c1914907 100644
--- a/libexif/fuji/exif-mnote-data-fuji.c
+++ b/libexif/fuji/exif-mnote-data-fuji.c
@@ -196,10 +196,11 @@ exif_mnote_data_fuji_load (ExifMnoteData *en,
 	/* Parse all c entries, storing ones that are successfully parsed */
 	tcount = 0;
 	for (i = c, o = datao; i; --i, o += 12) {
 		size_t s;
 
+		memset(&n->entries[tcount], 0, sizeof(MnoteFujiEntry));
 		if (CHECKOVERFLOW(o, buf_size, 12)) {
 			exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
 				  "ExifMnoteDataFuji", "Short MakerNote");
 			break;
 		}
diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
index bd83411e..1d1de2cb 100644
--- a/libexif/olympus/exif-mnote-data-olympus.c
+++ b/libexif/olympus/exif-mnote-data-olympus.c
@@ -423,10 +423,11 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
 
 	/* Parse all c entries, storing ones that are successfully parsed */
 	tcount = 0;
 	for (i = c, o = o2; i; --i, o += 12) {
 		size_t s;
+		memset(&n->entries[tcount], 0, sizeof(MnoteOlympusEntry));
 		if (CHECKOVERFLOW(o, buf_size, 12)) {
 			exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
 				  "ExifMnoteOlympus", "Short MakerNote");
 			break;
 		}
diff --git a/libexif/pentax/exif-mnote-data-pentax.c b/libexif/pentax/exif-mnote-data-pentax.c
index 5f75d8f3..5299e635 100644
--- a/libexif/pentax/exif-mnote-data-pentax.c
+++ b/libexif/pentax/exif-mnote-data-pentax.c
@@ -278,10 +278,11 @@ exif_mnote_data_pentax_load (ExifMnoteData *en,
 	/* Parse all c entries, storing ones that are successfully parsed */
 	tcount = 0;
 	for (i = c, o = datao; i; --i, o += 12) {
 		size_t s;
 
+		memset(&n->entries[tcount], 0, sizeof(MnotePentaxEntry));
 		if (CHECKOVERFLOW(o,buf_size,12)) {
 			exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA,
 				  "ExifMnoteDataPentax", "Short MakerNote");
 			break;
 		}

Fixed code: 		memset(&n->entries[tcount], 0, sizeof(MnoteCanonEntry));
		memset(&n->entries[tcount], 0, sizeof(MnoteFujiEntry));
		memset(&n->entries[tcount], 0, sizeof(MnoteOlympusEntry));
		memset(&n->entries[tcount], 0, sizeof(MnotePentaxEntry));