From ad9388ac300a163e9106fcd5b9bbb765bb6cd1ce Mon Sep 17 00:00:00 2001
From: peng2285 <jiangpeng01@ncti-gba.cn>
Date: Thu, 10 Nov 2022 17:03:06 +0800
Subject: [PATCH] fix CVE-2022-3755 and CVE-2022-3756

---
 CVE-2022-3755.patch | 28 ++++++++++++++++++++++++++++
 CVE-2022-3756.patch | 30 ++++++++++++++++++++++++++++++
 exiv2.spec          |  7 ++++++-
 3 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2022-3755.patch
 create mode 100644 CVE-2022-3756.patch

diff --git a/CVE-2022-3755.patch b/CVE-2022-3755.patch
new file mode 100644
index 0000000..9d40f8e
--- /dev/null
+++ b/CVE-2022-3755.patch
@@ -0,0 +1,28 @@
+From 789ec5408f885709eef0a820416658b6e3882c0c Mon Sep 17 00:00:00 2001
+From: qz_cx <wangqingzheng@kylinos.cn>
+Date: Mon, 31 Oct 2022 15:13:45 +0800
+Subject: [PATCH] Credit to
+ OSS-Fuzz:https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52382
+
+Avoid null pointer deref #2384
+ Merged
+kevinbackhouse merged 2 commits into Exiv2
+---
+ src/quicktimevideo.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/quicktimevideo.cpp b/src/quicktimevideo.cpp
+index 335d884..ef1a6e5 100644
+--- a/src/quicktimevideo.cpp
++++ b/src/quicktimevideo.cpp
+@@ -915,6 +915,7 @@ namespace Exiv2 {
+             }
+ 
+             else if(equalsQTimeTag(buf, "CMbo") || equalsQTimeTag(buf, "Cmbo")) {
++		enforce(tv, Exiv2::ErrorCode::kerCorruptedMetadata);
+                 io_->read(buf.pData_, 2);
+                 buf.pData_[2] = '\0' ;
+                 tv_internal = find(cameraByteOrderTags, Exiv2::toString( buf.pData_));
+-- 
+2.33.0
+
diff --git a/CVE-2022-3756.patch b/CVE-2022-3756.patch
new file mode 100644
index 0000000..90618e6
--- /dev/null
+++ b/CVE-2022-3756.patch
@@ -0,0 +1,30 @@
+From be374cc6cd51906eaacc7a4f77c9ac37ea7c69c7 Mon Sep 17 00:00:00 2001
+From: qz_cx <wangqingzheng@kylinos.cn>
+Date: Mon, 31 Oct 2022 14:29:31 +0800
+Subject: [PATCH] Avoid potential integer overflow.
+
+Merge pull request #2347 from kevinbackhouse/quicktimevideo-size-calc
+
+Avoid potential integer overflow in QuickTimeVideo::userDataDecoder
+@kevinbackhouse
+kevinbackhouse committed on 7 Sep
+---
+ src/quicktimevideo.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/quicktimevideo.cpp b/src/quicktimevideo.cpp
+index 335d884..9b80947 100644
+--- a/src/quicktimevideo.cpp
++++ b/src/quicktimevideo.cpp
+@@ -895,7 +895,7 @@ namespace Exiv2 {
+ 
+             tv = find(userDataReferencetags, Exiv2::toString( buf.pData_));
+ 
+-            if(size == 0 || (size - 12) <= 0)
++	    if (size <= 12)
+                 break;
+ 
+             else if(equalsQTimeTag(buf, "DcMD")  || equalsQTimeTag(buf, "NCDT"))
+-- 
+2.33.0
+
diff --git a/exiv2.spec b/exiv2.spec
index ce3f421..9650537 100644
--- a/exiv2.spec
+++ b/exiv2.spec
@@ -1,10 +1,12 @@
 Name:    exiv2
 Version: 0.27.5
-Release: 1
+Release: 2
 Summary: Exif, IPTC and XMP metadata and the ICC Profile
 License: GPLv2+
 URL:     http://www.exiv2.org/
 Source0: https://github.com/Exiv2/exiv2/archive/refs/tags/v%{version}.tar.gz
+Patch0001:  CVE-2022-3755.patch
+Patch0002:  CVE-2022-3756.patch
 
 Provides: exiv2-libs
 Obsoletes: exiv2-libs
@@ -74,6 +76,9 @@ test -x %{buildroot}%{_libdir}/libexiv2.so
 %{_pkgdocdir}/
 
 %changelog
+* Thu Nov 10 2022 jiangpeng <jiangpeng01@ncti-gba.cn> - 0.27.5-2
+- Fix CVE-2022-3755 CVE-2022-3756
+
 * Wed Nov 24 2021 wangkai <wangkai385@huawei.com> - 0.27.5-1
 - Upgrade to 0.27.5
 
-- 
Gitee