From dfe2e052e16c7a20808996c6abb8b16bc8e5d456 Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Sat, 10 Oct 2026 22:24:01 -0700 Subject: [PATCH] fix(tiff): 64-bit size for LONG-typed IPTC data The RICHTIFFIPTC count was read into an int and multiplied by 4 for LONG-typed fields, which can overflow for very large fields, and was then passed to decode_iptc_iim() as an int length. Assisted-by: Claude Code / Claude Sonnet 5.5 Signed-off-by: Larry Gritz --- src/tiff.imageio/tiffinput.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/tiff.imageio/tiffinput.cpp b/src/tiff.imageio/tiffinput.cpp index f3bdb4cb34..0314fb6beb 100644 --- a/src/tiff.imageio/tiffinput.cpp +++ b/src/tiff.imageio/tiffinput.cpp @@ -1554,12 +1554,13 @@ TIFFInput::readspec(bool read_meta) // Search for IPTC metadata in IIM form -- but older versions of // libtiff botch the size, so ignore it for very old libtiff. - int iptcsize = 0; + uint32_t iptccount = 0; const char* iptcdata = nullptr; TypeDesc iptctype = tiffgetfieldtype(TIFFTAG_RICHTIFFIPTC); - if (TIFFGetField(m_tif, TIFFTAG_RICHTIFFIPTC, &iptcsize, &iptcdata) - && iptcsize > 0) { + if (TIFFGetField(m_tif, TIFFTAG_RICHTIFFIPTC, &iptccount, &iptcdata) + && iptccount > 0 && iptcdata) { std::vector iptc; + size_t iptcsize = iptccount; if (iptctype.size() == 4) { // Some TIFF files in the wild inexplicably think their IPTC // data are stored as longs, and we have to undo any byte @@ -1571,7 +1572,7 @@ TIFFInput::readspec(bool read_meta) } else { iptc.assign(iptcdata, iptcdata + iptcsize); } - decode_iptc_iim(&iptc[0], iptcsize, m_spec); + decode_iptc_iim(string_view(iptc.data(), iptc.size()), m_spec); } // Search for an XML packet containing XMP (IPTC, Exif, etc.)