FFmpeg coverage

Directory: ../../../ffmpeg/
File: src/libavcodec/exif.c
Date: 2026-01-16 07:34:38
Exec Total Coverage
Lines: 583 851 68.5%
Functions: 28 30 93.3%
Branches: 332 607 54.7%
Line Branch Exec Source
1 /*
2 * EXIF metadata parser
3 * Copyright (c) 2013 Thilo Borgmann <thilo.borgmann _at_ mail.de>
4 * Copyright (c) 2024-2025 Leo Izen <leo.izen@gmail.com>
5 *
6 * This file is part of FFmpeg.
7 *
8 * FFmpeg is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * FFmpeg is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with FFmpeg; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21 */
22
23 /**
24 * @file
25 * EXIF metadata parser
26 * @author Thilo Borgmann <thilo.borgmann _at_ mail.de>
27 * @author Leo Izen <leo.izen@gmail.com>
28 */
29
30 #include <inttypes.h>
31
32 #include "libavutil/avconfig.h"
33 #include "libavutil/bprint.h"
34 #include "libavutil/display.h"
35 #include "libavutil/intreadwrite.h"
36 #include "libavutil/mem.h"
37
38 #include "bytestream.h"
39 #include "exif_internal.h"
40 #include "tiff_common.h"
41
42 #define EXIF_II_LONG 0x49492a00
43 #define EXIF_MM_LONG 0x4d4d002a
44
45 #define BASE_TAG_SIZE 12
46 #define IFD_EXTRA_SIZE 6
47
48 #define EXIF_TAG_NAME_LENGTH 32
49 #define MAKERNOTE_TAG 0x927c
50 #define ORIENTATION_TAG 0x112
51 #define EXIFIFD_TAG 0x8769
52 #define IMAGE_WIDTH_TAG 0x100
53 #define IMAGE_LENGTH_TAG 0x101
54 #define PIXEL_X_TAG 0xa002
55 #define PIXEL_Y_TAG 0xa003
56
57 struct exif_tag {
58 const char name[EXIF_TAG_NAME_LENGTH];
59 uint16_t id;
60 };
61
62 static const struct exif_tag tag_list[] = { // JEITA CP-3451 EXIF specification:
63 {"GPSVersionID", 0x00}, // <- Table 12 GPS Attribute Information
64 {"GPSLatitudeRef", 0x01},
65 {"GPSLatitude", 0x02},
66 {"GPSLongitudeRef", 0x03},
67 {"GPSLongitude", 0x04},
68 {"GPSAltitudeRef", 0x05},
69 {"GPSAltitude", 0x06},
70 {"GPSTimeStamp", 0x07},
71 {"GPSSatellites", 0x08},
72 {"GPSStatus", 0x09},
73 {"GPSMeasureMode", 0x0A},
74 {"GPSDOP", 0x0B},
75 {"GPSSpeedRef", 0x0C},
76 {"GPSSpeed", 0x0D},
77 {"GPSTrackRef", 0x0E},
78 {"GPSTrack", 0x0F},
79 {"GPSImgDirectionRef", 0x10},
80 {"GPSImgDirection", 0x11},
81 {"GPSMapDatum", 0x12},
82 {"GPSDestLatitudeRef", 0x13},
83 {"GPSDestLatitude", 0x14},
84 {"GPSDestLongitudeRef", 0x15},
85 {"GPSDestLongitude", 0x16},
86 {"GPSDestBearingRef", 0x17},
87 {"GPSDestBearing", 0x18},
88 {"GPSDestDistanceRef", 0x19},
89 {"GPSDestDistance", 0x1A},
90 {"GPSProcessingMethod", 0x1B},
91 {"GPSAreaInformation", 0x1C},
92 {"GPSDateStamp", 0x1D},
93 {"GPSDifferential", 0x1E},
94 {"ImageWidth", 0x100}, // <- Table 3 TIFF Rev. 6.0 Attribute Information Used in Exif
95 {"ImageLength", 0x101},
96 {"BitsPerSample", 0x102},
97 {"Compression", 0x103},
98 {"PhotometricInterpretation", 0x106},
99 {"Orientation", 0x112},
100 {"SamplesPerPixel", 0x115},
101 {"PlanarConfiguration", 0x11C},
102 {"YCbCrSubSampling", 0x212},
103 {"YCbCrPositioning", 0x213},
104 {"XResolution", 0x11A},
105 {"YResolution", 0x11B},
106 {"ResolutionUnit", 0x128},
107 {"StripOffsets", 0x111},
108 {"RowsPerStrip", 0x116},
109 {"StripByteCounts", 0x117},
110 {"JPEGInterchangeFormat", 0x201},
111 {"JPEGInterchangeFormatLength",0x202},
112 {"TransferFunction", 0x12D},
113 {"WhitePoint", 0x13E},
114 {"PrimaryChromaticities", 0x13F},
115 {"YCbCrCoefficients", 0x211},
116 {"ReferenceBlackWhite", 0x214},
117 {"DateTime", 0x132},
118 {"ImageDescription", 0x10E},
119 {"Make", 0x10F},
120 {"Model", 0x110},
121 {"Software", 0x131},
122 {"Artist", 0x13B},
123 {"Copyright", 0x8298},
124 {"ExifVersion", 0x9000}, // <- Table 4 Exif IFD Attribute Information (1)
125 {"FlashpixVersion", 0xA000},
126 {"ColorSpace", 0xA001},
127 {"ComponentsConfiguration", 0x9101},
128 {"CompressedBitsPerPixel", 0x9102},
129 {"PixelXDimension", 0xA002},
130 {"PixelYDimension", 0xA003},
131 {"MakerNote", 0x927C},
132 {"UserComment", 0x9286},
133 {"RelatedSoundFile", 0xA004},
134 {"DateTimeOriginal", 0x9003},
135 {"DateTimeDigitized", 0x9004},
136 {"SubSecTime", 0x9290},
137 {"SubSecTimeOriginal", 0x9291},
138 {"SubSecTimeDigitized", 0x9292},
139 {"ImageUniqueID", 0xA420},
140 {"ExposureTime", 0x829A}, // <- Table 5 Exif IFD Attribute Information (2)
141 {"FNumber", 0x829D},
142 {"ExposureProgram", 0x8822},
143 {"SpectralSensitivity", 0x8824},
144 {"ISOSpeedRatings", 0x8827},
145 {"OECF", 0x8828},
146 {"ShutterSpeedValue", 0x9201},
147 {"ApertureValue", 0x9202},
148 {"BrightnessValue", 0x9203},
149 {"ExposureBiasValue", 0x9204},
150 {"MaxApertureValue", 0x9205},
151 {"SubjectDistance", 0x9206},
152 {"MeteringMode", 0x9207},
153 {"LightSource", 0x9208},
154 {"Flash", 0x9209},
155 {"FocalLength", 0x920A},
156 {"SubjectArea", 0x9214},
157 {"FlashEnergy", 0xA20B},
158 {"SpatialFrequencyResponse", 0xA20C},
159 {"FocalPlaneXResolution", 0xA20E},
160 {"FocalPlaneYResolution", 0xA20F},
161 {"FocalPlaneResolutionUnit", 0xA210},
162 {"SubjectLocation", 0xA214},
163 {"ExposureIndex", 0xA215},
164 {"SensingMethod", 0xA217},
165 {"FileSource", 0xA300},
166 {"SceneType", 0xA301},
167 {"CFAPattern", 0xA302},
168 {"CustomRendered", 0xA401},
169 {"ExposureMode", 0xA402},
170 {"WhiteBalance", 0xA403},
171 {"DigitalZoomRatio", 0xA404},
172 {"FocalLengthIn35mmFilm", 0xA405},
173 {"SceneCaptureType", 0xA406},
174 {"GainControl", 0xA407},
175 {"Contrast", 0xA408},
176 {"Saturation", 0xA409},
177 {"Sharpness", 0xA40A},
178 {"DeviceSettingDescription", 0xA40B},
179 {"SubjectDistanceRange", 0xA40C},
180
181 /* InteropIFD tags */
182 {"RelatedImageFileFormat", 0x1000},
183 {"RelatedImageWidth", 0x1001},
184 {"RelatedImageLength", 0x1002},
185
186 /* private EXIF tags */
187 {"PrintImageMatching", 0xC4A5}, // <- undocumented meaning
188
189 /* IFD tags */
190 {"ExifIFD", 0x8769}, // <- An IFD pointing to standard Exif metadata
191 {"GPSInfo", 0x8825}, // <- An IFD pointing to GPS Exif Metadata
192 {"InteropIFD", 0xA005}, // <- Table 13 Interoperability IFD Attribute Information
193 {"GlobalParametersIFD", 0x0190},
194 {"ProfileIFD", 0xc6f5},
195
196 /* Extra FFmpeg tags */
197 { "IFD1", 0xFFFC},
198 { "IFD2", 0xFFFB},
199 { "IFD3", 0xFFFA},
200 { "IFD4", 0xFFF9},
201 { "IFD5", 0xFFF8},
202 { "IFD6", 0xFFF7},
203 { "IFD7", 0xFFF6},
204 { "IFD8", 0xFFF5},
205 { "IFD9", 0xFFF4},
206 { "IFD10", 0xFFF3},
207 { "IFD11", 0xFFF2},
208 { "IFD12", 0xFFF1},
209 { "IFD13", 0xFFF0},
210 { "IFD14", 0xFFEF},
211 { "IFD15", 0xFFEE},
212 { "IFD16", 0xFFED},
213 };
214
215 /* same as type_sizes but with string == 1 */
216 static const size_t exif_sizes[] = {
217 [0] = 0,
218 [AV_TIFF_BYTE] = 1,
219 [AV_TIFF_STRING] = 1,
220 [AV_TIFF_SHORT] = 2,
221 [AV_TIFF_LONG] = 4,
222 [AV_TIFF_RATIONAL] = 8,
223 [AV_TIFF_SBYTE] = 1,
224 [AV_TIFF_UNDEFINED] = 1,
225 [AV_TIFF_SSHORT] = 2,
226 [AV_TIFF_SLONG] = 4,
227 [AV_TIFF_SRATIONAL] = 8,
228 [AV_TIFF_FLOAT] = 4,
229 [AV_TIFF_DOUBLE] = 8,
230 [AV_TIFF_IFD] = 4,
231 };
232
233 930 const char *av_exif_get_tag_name(uint16_t id)
234 {
235
2/2
✓ Branch 0 taken 73275 times.
✓ Branch 1 taken 288 times.
 73563 for (size_t i = 0; i < FF_ARRAY_ELEMS(tag_list); i++) {
236
2/2
✓ Branch 0 taken 642 times.
✓ Branch 1 taken 72633 times.
 73275 if (tag_list[i].id == id)
237 642 return tag_list[i].name;
238 }
239
240 288 return NULL;
241 }
242
243 325 int32_t av_exif_get_tag_id(const char *name)
244 {
245
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 325 times.
 325 if (!name)
246 ✗ return -1;
247
248
1/2
✓ Branch 0 taken 12025 times.
✗ Branch 1 not taken.
 12025 for (size_t i = 0; i < FF_ARRAY_ELEMS(tag_list); i++) {
249
2/2
✓ Branch 0 taken 325 times.
✓ Branch 1 taken 11700 times.
 12025 if (!strcmp(tag_list[i].name, name))
250 325 return tag_list[i].id;
251 }
252
253 ✗ return -1;
254 }
255
256 4523 static inline void tput16(PutByteContext *pb, const int le, const uint16_t value)
257 {
258
1/2
✓ Branch 0 taken 4523 times.
✗ Branch 1 not taken.
 4523 le ? bytestream2_put_le16(pb, value) : bytestream2_put_be16(pb, value);
259 4523 }
260
261 4169 static inline void tput32(PutByteContext *pb, const int le, const uint32_t value)
262 {
263
1/2
✓ Branch 0 taken 4169 times.
✗ Branch 1 not taken.
 4169 le ? bytestream2_put_le32(pb, value) : bytestream2_put_be32(pb, value);
264 4169 }
265
266 ✗ static inline void tput64(PutByteContext *pb, const int le, const uint64_t value)
267 {
268 ✗ le ? bytestream2_put_le64(pb, value) : bytestream2_put_be64(pb, value);
269 ✗ }
270
271 1888 static int exif_read_values(void *logctx, GetByteContext *gb, int le, AVExifEntry *entry)
272 {
273
5/9
✓ Branch 0 taken 1278 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 20 times.
✓ Branch 3 taken 247 times.
✓ Branch 4 taken 194 times.
✗ Branch 5 not taken.
✓ Branch 6 taken 149 times.
✗ Branch 7 not taken.
✗ Branch 8 not taken.
 1888 switch (entry->type) {
274 1278 case AV_TIFF_SHORT:
275 case AV_TIFF_LONG:
276 1278 entry->value.uint = av_calloc(entry->count, sizeof(*entry->value.uint));
277 1278 break;
278 ✗ case AV_TIFF_SSHORT:
279 case AV_TIFF_SLONG:
280 ✗ entry->value.sint = av_calloc(entry->count, sizeof(*entry->value.sint));
281 ✗ break;
282 20 case AV_TIFF_DOUBLE:
283 case AV_TIFF_FLOAT:
284 20 entry->value.dbl = av_calloc(entry->count, sizeof(*entry->value.dbl));
285 20 break;
286 247 case AV_TIFF_RATIONAL:
287 case AV_TIFF_SRATIONAL:
288 247 entry->value.rat = av_calloc(entry->count, sizeof(*entry->value.rat));
289 247 break;
290 194 case AV_TIFF_UNDEFINED:
291 case AV_TIFF_BYTE:
292 194 entry->value.ubytes = av_mallocz(entry->count);
293 194 break;
294 ✗ case AV_TIFF_SBYTE:
295 ✗ entry->value.sbytes = av_mallocz(entry->count);
296 ✗ break;
297 149 case AV_TIFF_STRING:
298 149 entry->value.str = av_mallocz(entry->count + 1);
299 149 break;
300 ✗ case AV_TIFF_IFD:
301 ✗ av_log(logctx, AV_LOG_WARNING, "Bad IFD type for non-IFD tag\n");
302 ✗ return AVERROR_INVALIDDATA;
303 }
304
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1888 times.
 1888 if (!entry->value.ptr)
305 ✗ return AVERROR(ENOMEM);
306
6/11
✓ Branch 0 taken 953 times.
✓ Branch 1 taken 325 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 20 times.
✓ Branch 6 taken 247 times.
✓ Branch 7 taken 194 times.
✗ Branch 8 not taken.
✓ Branch 9 taken 149 times.
✗ Branch 10 not taken.
 1888 switch (entry->type) {
307 953 case AV_TIFF_SHORT:
308
2/2
✓ Branch 0 taken 2853 times.
✓ Branch 1 taken 953 times.
 3806 for (size_t i = 0; i < entry->count; i++)
309 2853 entry->value.uint[i] = ff_tget_short(gb, le);
310 953 break;
311 325 case AV_TIFF_LONG:
312
2/2
✓ Branch 0 taken 2490 times.
✓ Branch 1 taken 325 times.
 2815 for (size_t i = 0; i < entry->count; i++)
313 2490 entry->value.uint[i] = ff_tget_long(gb, le);
314 325 break;
315 ✗ case AV_TIFF_SSHORT:
316 ✗ for (size_t i = 0; i < entry->count; i++)
317 ✗ entry->value.sint[i] = (int16_t) ff_tget_short(gb, le);
318 ✗ break;
319 ✗ case AV_TIFF_SLONG:
320 ✗ for (size_t i = 0; i < entry->count; i++)
321 ✗ entry->value.sint[i] = (int32_t) ff_tget_long(gb, le);
322 ✗ break;
323 ✗ case AV_TIFF_DOUBLE:
324 ✗ for (size_t i = 0; i < entry->count; i++)
325 ✗ entry->value.dbl[i] = ff_tget_double(gb, le);
326 ✗ break;
327 20 case AV_TIFF_FLOAT:
328
2/2
✓ Branch 0 taken 68 times.
✓ Branch 1 taken 20 times.
 88 for (size_t i = 0; i < entry->count; i++) {
329 68 av_alias32 alias = { .u32 = ff_tget_long(gb, le) };
330 68 entry->value.dbl[i] = alias.f32;
331 }
332 20 break;
333 247 case AV_TIFF_RATIONAL:
334 case AV_TIFF_SRATIONAL:
335
2/2
✓ Branch 0 taken 356 times.
✓ Branch 1 taken 247 times.
 603 for (size_t i = 0; i < entry->count; i++) {
336 356 int32_t num = ff_tget_long(gb, le);
337 356 int32_t den = ff_tget_long(gb, le);
338 356 entry->value.rat[i] = av_make_q(num, den);
339 }
340 247 break;
341 194 case AV_TIFF_UNDEFINED:
342 case AV_TIFF_BYTE:
343 /* these three fields are aliased to entry->value.ptr via a union */
344 /* and entry->value.ptr will always be nonzero here */
345
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 194 times.
 194 av_assert0(entry->value.ubytes);
346 194 bytestream2_get_buffer(gb, entry->value.ubytes, entry->count);
347 194 break;
348 ✗ case AV_TIFF_SBYTE:
349 ✗ av_assert0(entry->value.sbytes);
350 ✗ bytestream2_get_buffer(gb, entry->value.sbytes, entry->count);
351 ✗ break;
352 149 case AV_TIFF_STRING:
353
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 149 times.
 149 av_assert0(entry->value.str);
354 149 bytestream2_get_buffer(gb, entry->value.str, entry->count);
355 149 break;
356 }
357
358 1888 return 0;
359 }
360
361 1205 static void exif_write_values(PutByteContext *pb, int le, const AVExifEntry *entry)
362 {
363
6/11
✓ Branch 0 taken 597 times.
✓ Branch 1 taken 217 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 10 times.
✓ Branch 6 taken 161 times.
✓ Branch 7 taken 128 times.
✗ Branch 8 not taken.
✓ Branch 9 taken 92 times.
✗ Branch 10 not taken.
 1205 switch (entry->type) {
364 597 case AV_TIFF_SHORT:
365
2/2
✓ Branch 0 taken 1998 times.
✓ Branch 1 taken 597 times.
 2595 for (size_t i = 0; i < entry->count; i++)
366 1998 tput16(pb, le, entry->value.uint[i]);
367 597 break;
368 217 case AV_TIFF_LONG:
369
2/2
✓ Branch 0 taken 1918 times.
✓ Branch 1 taken 217 times.
 2135 for (size_t i = 0; i < entry->count; i++)
370 1918 tput32(pb, le, entry->value.uint[i]);
371 217 break;
372 ✗ case AV_TIFF_SSHORT:
373 ✗ for (size_t i = 0; i < entry->count; i++)
374 ✗ tput16(pb, le, entry->value.sint[i]);
375 ✗ break;
376 ✗ case AV_TIFF_SLONG:
377 ✗ for (size_t i = 0; i < entry->count; i++)
378 ✗ tput32(pb, le, entry->value.sint[i]);
379 ✗ break;
380 ✗ case AV_TIFF_DOUBLE:
381 ✗ for (size_t i = 0; i < entry->count; i++) {
382 ✗ const av_alias64 a = { .f64 = entry->value.dbl[i] };
383 ✗ tput64(pb, le, a.u64);
384 }
385 ✗ break;
386 10 case AV_TIFF_FLOAT:
387
2/2
✓ Branch 0 taken 34 times.
✓ Branch 1 taken 10 times.
 44 for (size_t i = 0; i < entry->count; i++) {
388 34 const av_alias32 a = { .f32 = entry->value.dbl[i] };
389 34 tput32(pb, le, a.u32);
390 }
391 10 break;
392 161 case AV_TIFF_RATIONAL:
393 case AV_TIFF_SRATIONAL:
394
2/2
✓ Branch 0 taken 217 times.
✓ Branch 1 taken 161 times.
 378 for (size_t i = 0; i < entry->count; i++) {
395 217 tput32(pb, le, entry->value.rat[i].num);
396 217 tput32(pb, le, entry->value.rat[i].den);
397 }
398 161 break;
399 128 case AV_TIFF_UNDEFINED:
400 case AV_TIFF_BYTE:
401 128 bytestream2_put_buffer(pb, entry->value.ubytes, entry->count);
402 128 break;
403 ✗ case AV_TIFF_SBYTE:
404 ✗ bytestream2_put_buffer(pb, entry->value.sbytes, entry->count);
405 ✗ break;
406 92 case AV_TIFF_STRING:
407 92 bytestream2_put_buffer(pb, entry->value.str, entry->count);
408 92 break;
409 }
410 1205 }
411
412 static const uint8_t aoc_header[] = { 'A', 'O', 'C', 0, };
413 static const uint8_t casio_header[] = { 'Q', 'V', 'C', 0, 0, 0, };
414 static const uint8_t foveon_header[] = { 'F', 'O', 'V', 'E', 'O', 'N', 0, 0, };
415 static const uint8_t fuji_header[] = { 'F', 'U', 'J', 'I', };
416 static const uint8_t nikon_header[] = { 'N', 'i', 'k', 'o', 'n', 0, };
417 static const uint8_t olympus1_header[] = { 'O', 'L', 'Y', 'M', 'P', 0, };
418 static const uint8_t olympus2_header[] = { 'O', 'L', 'Y', 'M', 'P', 'U', 'S', 0, 'I', 'I', };
419 static const uint8_t panasonic_header[] = { 'P', 'a', 'n', 'a', 's', 'o', 'n', 'i', 'c', 0, 0, 0, };
420 static const uint8_t sigma_header[] = { 'S', 'I', 'G', 'M', 'A', 0, 0, 0, };
421 static const uint8_t sony_header[] = { 'S', 'O', 'N', 'Y', ' ', 'D', 'S', 'C', ' ', 0, 0, 0, };
422
423 struct exif_makernote_data {
424 const uint8_t *header;
425 size_t header_size;
426 int result;
427 };
428
429 #define MAKERNOTE_STRUCT(h, r) { \
430 .header = (h), \
431 .header_size = sizeof((h)), \
432 .result = (r), \
433 }
434
435 static const struct exif_makernote_data makernote_data[] = {
436 MAKERNOTE_STRUCT(aoc_header, 6),
437 MAKERNOTE_STRUCT(casio_header, -1),
438 MAKERNOTE_STRUCT(foveon_header, 10),
439 MAKERNOTE_STRUCT(fuji_header, -1),
440 MAKERNOTE_STRUCT(olympus1_header, 8),
441 MAKERNOTE_STRUCT(olympus2_header, -1),
442 MAKERNOTE_STRUCT(panasonic_header, 12),
443 MAKERNOTE_STRUCT(sigma_header, 10),
444 MAKERNOTE_STRUCT(sony_header, 12),
445 };
446
447 /*
448 * derived from Exiv2 MakerNote's article
449 * https://exiv2.org/makernote.html or archived at
450 * https://web.archive.org/web/20250311155857/https://exiv2.org/makernote.html
451 */
452 7 static int exif_get_makernote_offset(GetByteContext *gb)
453 {
454
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 7 times.
 7 if (bytestream2_get_bytes_left(gb) < BASE_TAG_SIZE)
455 ✗ return -1;
456
457
2/2
✓ Branch 0 taken 57 times.
✓ Branch 1 taken 4 times.
 61 for (int i = 0; i < FF_ARRAY_ELEMS(makernote_data); i++) {
458
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 54 times.
 57 if (!memcmp(gb->buffer, makernote_data[i].header, makernote_data[i].header_size))
459 3 return makernote_data[i].result;
460 }
461
462
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (!memcmp(gb->buffer, nikon_header, sizeof(nikon_header))) {
463 ✗ if (bytestream2_get_bytes_left(gb) < 14)
464 ✗ return -1;
465 ✗ else if (AV_RB32(gb->buffer + 10) == EXIF_MM_LONG || AV_RB32(gb->buffer + 10) == EXIF_II_LONG)
466 ✗ return -1;
467 ✗ return 8;
468 }
469
470 4 return 0;
471 }
472
473 static int exif_parse_ifd_list(void *logctx, GetByteContext *gb, int le,
474 int depth, AVExifMetadata *ifd, int guess);
475
476 1920 static int exif_decode_tag(void *logctx, GetByteContext *gb, int le,
477 int depth, AVExifEntry *entry)
478 {
479 1920 int ret = 0, makernote_offset = -1, tell, is_ifd, count;
480 enum AVTiffDataType type;
481 uint32_t payload;
482
483 /* safety check to prevent infinite recursion on malicious IFDs */
484
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1920 times.
 1920 if (depth > 3)
485 ✗ return AVERROR_INVALIDDATA;
486
487 1920 tell = bytestream2_tell(gb);
488
489 1920 entry->id = ff_tget_short(gb, le);
490 1920 type = ff_tget_short(gb, le);
491 1920 count = ff_tget_long(gb, le);
492 1920 payload = ff_tget_long(gb, le);
493
494 1920 av_log(logctx, AV_LOG_DEBUG, "TIFF Tag: id: 0x%04x, type: %d, count: %u, offset: %d, "
495 1920 "payload: %" PRIu32 "\n", entry->id, type, count, tell, payload);
496
497 /* AV_TIFF_IFD is the largest, numerically */
498
2/4
✓ Branch 0 taken 1920 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 1920 times.
 1920 if (type > AV_TIFF_IFD || count >= INT_MAX/8U)
499 ✗ return AVERROR_INVALIDDATA;
500
501
6/6
✓ Branch 0 taken 1915 times.
✓ Branch 1 taken 5 times.
✓ Branch 3 taken 1895 times.
✓ Branch 4 taken 20 times.
✓ Branch 5 taken 7 times.
✓ Branch 6 taken 1888 times.
 1920 is_ifd = type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG;
502
503
2/2
✓ Branch 0 taken 32 times.
✓ Branch 1 taken 1888 times.
 1920 if (is_ifd) {
504
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 32 times.
 32 if (!payload)
505 ✗ goto end;
506 32 bytestream2_seek(gb, payload, SEEK_SET);
507 }
508
509
2/2
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 1913 times.
 1920 if (entry->id == MAKERNOTE_TAG) {
510 7 makernote_offset = exif_get_makernote_offset(gb);
511
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (makernote_offset < 0)
512 ✗ is_ifd = 0;
513 }
514
515
2/2
✓ Branch 0 taken 32 times.
✓ Branch 1 taken 1888 times.
 1920 if (is_ifd) {
516 32 entry->type = AV_TIFF_IFD;
517 32 entry->count = 1;
518 32 entry->ifd_offset = makernote_offset > 0 ? makernote_offset : 0;
519
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 29 times.
 32 if (entry->ifd_offset) {
520 3 entry->ifd_lead = av_malloc(entry->ifd_offset);
521
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (!entry->ifd_lead)
522 ✗ return AVERROR(ENOMEM);
523 3 bytestream2_get_buffer(gb, entry->ifd_lead, entry->ifd_offset);
524 }
525 32 ret = exif_parse_ifd_list(logctx, gb, le, depth + 1, &entry->value.ifd, entry->id == MAKERNOTE_TAG);
526
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 32 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 32 if (ret < 0 && entry->id == MAKERNOTE_TAG) {
527 /*
528 * we guessed that MakerNote was an IFD
529 * but we were probably incorrect at this
530 * point so we try again as a binary blob
531 */
532 ✗ av_log(logctx, AV_LOG_DEBUG, "unrecognized MakerNote IFD, retrying as blob\n");
533 ✗ is_ifd = 0;
534 }
535 }
536
537 /* inverted condition instead of else so we can fall through from above */
538
2/2
✓ Branch 0 taken 32 times.
✓ Branch 1 taken 1888 times.
 1920 if (!is_ifd) {
539
1/2
✓ Branch 0 taken 1888 times.
✗ Branch 1 not taken.
 1888 entry->type = type == AV_TIFF_IFD ? AV_TIFF_UNDEFINED : type;
540 1888 entry->count = count;
541
2/2
✓ Branch 0 taken 1252 times.
✓ Branch 1 taken 636 times.
 1888 bytestream2_seek(gb, count * exif_sizes[type] > 4 ? payload : tell + 8, SEEK_SET);
542 1888 ret = exif_read_values(logctx, gb, le, entry);
543 }
544
545 32 end:
546 1920 bytestream2_seek(gb, tell + BASE_TAG_SIZE, SEEK_SET);
547
548 1920 return ret;
549 }
550
551 119 static int exif_parse_ifd_list(void *logctx, GetByteContext *gb, int le,
552 int depth, AVExifMetadata *ifd, int guess)
553 {
554 uint32_t entries;
555 size_t required_size;
556 void *temp;
557 119 int ret = 0;
558
559 119 av_log(logctx, AV_LOG_DEBUG, "parsing IFD list at offset: %d\n", bytestream2_tell(gb));
560
561
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 119 times.
 119 if (bytestream2_get_bytes_left(gb) < 2) {
562 ✗ av_log(logctx, guess ? AV_LOG_DEBUG : AV_LOG_ERROR,
563 "not enough bytes remaining in EXIF buffer: 2 required\n");
564 ✗ ret = AVERROR_INVALIDDATA;
565 ✗ goto end;
566 }
567
568 119 entries = ff_tget_short(gb, le);
569
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 119 times.
 119 if (bytestream2_get_bytes_left(gb) < entries * BASE_TAG_SIZE) {
570 ✗ av_log(logctx, guess ? AV_LOG_DEBUG : AV_LOG_ERROR,
571 "not enough bytes remaining in EXIF buffer. entries: %" PRIu32 "\n", entries);
572 ✗ ret = AVERROR_INVALIDDATA;
573 ✗ goto end;
574 }
575
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 119 times.
 119 if (entries > 4096) {
576 /* that is a lot of entries, probably an error */
577 ✗ av_log(logctx, guess ? AV_LOG_DEBUG : AV_LOG_ERROR,
578 "too many entries: %" PRIu32 "\n", entries);
579 ✗ ret = AVERROR_INVALIDDATA;
580 ✗ goto end;
581 }
582
583 119 ifd->count = entries;
584 119 av_log(logctx, AV_LOG_DEBUG, "entry count for IFD: %u\n", ifd->count);
585
586 /* empty IFD is technically legal but equivalent to no metadata present */
587
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 119 times.
 119 if (!ifd->count) {
588 ✗ ret = 0;
589 ✗ goto end;
590 }
591
592
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 119 times.
 119 if (av_size_mult(ifd->count, sizeof(*ifd->entries), &required_size) < 0) {
593 ✗ ret = AVERROR(ENOMEM);
594 ✗ goto end;
595 }
596 119 temp = av_fast_realloc(ifd->entries, &ifd->size, required_size);
597
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 119 times.
 119 if (!temp) {
598 ✗ av_freep(&ifd->entries);
599 ✗ ret = AVERROR(ENOMEM);
600 ✗ goto end;
601 }
602 119 ifd->entries = temp;
603
604 /* entries have pointers in them which can cause issues if */
605 /* they are freed or realloc'd when garbage */
606 119 memset(ifd->entries, 0, required_size);
607
608
2/2
✓ Branch 0 taken 1920 times.
✓ Branch 1 taken 119 times.
 2039 for (uint32_t i = 0; i < entries; i++) {
609 1920 ret = exif_decode_tag(logctx, gb, le, depth, &ifd->entries[i]);
610
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1920 times.
 1920 if (ret < 0)
611 ✗ goto end;
612 }
613
614 119 end:
615
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 119 times.
 119 if (ret < 0) {
616 ✗ av_exif_free(ifd);
617 ✗ return ret;
618 }
619 /*
620 * at the end of an IFD is an pointer to the next IFD
621 * or zero if there are no more IFDs, which is usually the case
622 */
623 119 ret = ff_tget_long(gb, le);
624
625 /* overflow */
626
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 119 times.
 119 if (ret < 0) {
627 ✗ ret = AVERROR_INVALIDDATA;
628 ✗ av_exif_free(ifd);
629 }
630
631 119 return ret;
632 }
633
634 /*
635 * note that this function does not free the entry pointer itself
636 * because it's probably part of a larger array that should be freed
637 * all at once
638 */
639 3343 static void exif_free_entry(AVExifEntry *entry)
640 {
641
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3343 times.
 3343 if (!entry)
642 ✗ return;
643
2/2
✓ Branch 0 taken 82 times.
✓ Branch 1 taken 3261 times.
 3343 if (entry->type == AV_TIFF_IFD)
644 82 av_exif_free(&entry->value.ifd);
645 else
646 3261 av_freep(&entry->value.ptr);
647 3343 av_freep(&entry->ifd_lead);
648 }
649
650 3760 void av_exif_free(AVExifMetadata *ifd)
651 {
652
2/2
✓ Branch 0 taken 55 times.
✓ Branch 1 taken 3705 times.
 3760 if (!ifd)
653 55 return;
654
2/2
✓ Branch 0 taken 3505 times.
✓ Branch 1 taken 200 times.
 3705 if (!ifd->entries) {
655 3505 ifd->count = 0;
656 3505 ifd->size = 0;
657 3505 return;
658 }
659
2/2
✓ Branch 0 taken 3315 times.
✓ Branch 1 taken 200 times.
 3515 for (size_t i = 0; i < ifd->count; i++) {
660 3315 AVExifEntry *entry = &ifd->entries[i];
661 3315 exif_free_entry(entry);
662 }
663 200 av_freep(&ifd->entries);
664 200 ifd->count = 0;
665 200 ifd->size = 0;
666 }
667
668 76 static size_t exif_get_ifd_size(const AVExifMetadata *ifd)
669 {
670 /* 6 == 4 + 2; 2-byte entry-count at the beginning */
671 /* plus 4-byte next-IFD pointer at the end */
672 76 size_t total_size = IFD_EXTRA_SIZE;
673
2/2
✓ Branch 0 taken 1711 times.
✓ Branch 1 taken 76 times.
 1787 for (size_t i = 0; i < ifd->count; i++) {
674 1711 const AVExifEntry *entry = &ifd->entries[i];
675
2/2
✓ Branch 0 taken 29 times.
✓ Branch 1 taken 1682 times.
 1711 if (entry->type == AV_TIFF_IFD) {
676 29 total_size += BASE_TAG_SIZE + exif_get_ifd_size(&entry->value.ifd) + entry->ifd_offset;
677 } else {
678 1682 size_t payload_size = entry->count * exif_sizes[entry->type];
679
2/2
✓ Branch 0 taken 564 times.
✓ Branch 1 taken 1118 times.
 1682 total_size += BASE_TAG_SIZE + (payload_size > 4 ? payload_size : 0);
680 }
681 }
682 76 return total_size;
683 }
684
685 71 static int exif_write_ifd(void *logctx, PutByteContext *pb, int le, int depth, const AVExifMetadata *ifd)
686 {
687 int offset, ret, tell, tell2;
688 71 tell = bytestream2_tell_p(pb);
689 71 tput16(pb, le, ifd->count);
690 71 offset = tell + IFD_EXTRA_SIZE + BASE_TAG_SIZE * (uint32_t) ifd->count;
691 71 av_log(logctx, AV_LOG_DEBUG, "writing IFD with %u entries and initial offset %d\n", ifd->count, offset);
692
2/2
✓ Branch 0 taken 1227 times.
✓ Branch 1 taken 71 times.
 1298 for (size_t i = 0; i < ifd->count; i++) {
693 1227 const AVExifEntry *entry = &ifd->entries[i];
694 1227 av_log(logctx, AV_LOG_DEBUG, "writing TIFF entry: id: 0x%04" PRIx16 ", type: %d, count: %"
695 PRIu32 ", offset: %d, offset value: %d\n",
696 1227 entry->id, entry->type, entry->count,
697 bytestream2_tell_p(pb), offset);
698 1227 tput16(pb, le, entry->id);
699
3/4
✓ Branch 0 taken 5 times.
✓ Branch 1 taken 1222 times.
✓ Branch 2 taken 5 times.
✗ Branch 3 not taken.
 1232 if (entry->id == MAKERNOTE_TAG && entry->type == AV_TIFF_IFD) {
700 5 size_t ifd_size = exif_get_ifd_size(&entry->value.ifd);
701 5 tput16(pb, le, AV_TIFF_UNDEFINED);
702 5 tput32(pb, le, ifd_size);
703 } else {
704 1222 tput16(pb, le, entry->type);
705 1222 tput32(pb, le, entry->count);
706 }
707
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 1205 times.
 1227 if (entry->type == AV_TIFF_IFD) {
708 22 tput32(pb, le, offset);
709 22 tell2 = bytestream2_tell_p(pb);
710 22 bytestream2_seek_p(pb, offset, SEEK_SET);
711
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 20 times.
 22 if (entry->ifd_offset)
712 2 bytestream2_put_buffer(pb, entry->ifd_lead, entry->ifd_offset);
713 22 ret = exif_write_ifd(logctx, pb, le, depth + 1, &entry->value.ifd);
714
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 22 times.
 22 if (ret < 0)
715 ✗ return ret;
716 22 offset += ret + entry->ifd_offset;
717 22 bytestream2_seek_p(pb, tell2, SEEK_SET);
718 } else {
719 1205 size_t payload_size = entry->count * exif_sizes[entry->type];
720
2/2
✓ Branch 0 taken 414 times.
✓ Branch 1 taken 791 times.
 1205 if (payload_size > 4) {
721 414 tput32(pb, le, offset);
722 414 tell2 = bytestream2_tell_p(pb);
723 414 bytestream2_seek_p(pb, offset, SEEK_SET);
724 414 exif_write_values(pb, le, entry);
725 414 offset += payload_size;
726 414 bytestream2_seek_p(pb, tell2, SEEK_SET);
727 } else {
728 /* zero uninitialized excess payload values */
729 791 AV_WN32(pb->buffer, 0);
730 791 exif_write_values(pb, le, entry);
731 791 bytestream2_seek_p(pb, 4 - payload_size, SEEK_CUR);
732 }
733 }
734 }
735
736 /*
737 * we write 0 if this is the top-level exif IFD
738 * indicating that there are no more IFD pointers
739 */
740
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 49 times.
 71 tput32(pb, le, depth ? offset : 0);
741 71 return offset - tell;
742 }
743
744 42 int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, enum AVExifHeaderMode header_mode)
745 {
746 42 AVBufferRef *buf = NULL;
747 42 size_t size, headsize = 8;
748 PutByteContext pb;
749 42 int ret = 0, off = 0, next;
750 42 AVExifMetadata *ifd_new = NULL;
751 42 AVExifMetadata extra_ifds[16] = { 0 };
752
753 42 int le = 1;
754
755
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (*buffer) {
756 ✗ ret = AVERROR(EINVAL);
757 ✗ goto end;
758 }
759
760 42 size = exif_get_ifd_size(ifd);
761
2/5
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 40 times.
 42 switch (header_mode) {
762 ✗ case AV_EXIF_EXIF00:
763 ✗ off = 6;
764 ✗ break;
765 2 case AV_EXIF_T_OFF:
766 2 off = 4;
767 2 break;
768 ✗ case AV_EXIF_ASSUME_BE:
769 ✗ le = 0;
770 ✗ headsize = 0;
771 ✗ break;
772 ✗ case AV_EXIF_ASSUME_LE:
773 ✗ le = 1;
774 ✗ headsize = 0;
775 ✗ break;
776 }
777
778 42 ret = av_buffer_realloc(&buf, size + off + headsize);
779
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (ret < 0)
780 ✗ goto end;
781
782
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (header_mode == AV_EXIF_EXIF00) {
783 ✗ AV_WL32(buf->data, MKTAG('E','x','i','f'));
784 ✗ AV_WN16(buf->data + 4, 0);
785
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 40 times.
 42 } else if (header_mode == AV_EXIF_T_OFF) {
786 2 AV_WN32(buf->data, 0);
787 }
788
789 42 bytestream2_init_writer(&pb, buf->data + off, buf->size - off);
790
791
2/4
✓ Branch 0 taken 42 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 42 times.
✗ Branch 3 not taken.
 42 if (header_mode != AV_EXIF_ASSUME_BE && header_mode != AV_EXIF_ASSUME_LE) {
792 /* these constants are be32 in both cases */
793 /* le == 1 always in this case */
794 42 bytestream2_put_be32(&pb, EXIF_II_LONG);
795 42 tput32(&pb, le, 8);
796 }
797
798 42 int extras = 0;
799
2/2
✓ Branch 0 taken 672 times.
✓ Branch 1 taken 42 times.
 714 for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++) {
800 672 AVExifEntry *extra_entry = NULL;
801 672 uint16_t extra_tag = 0xFFFCu - i;
802 672 ret = av_exif_get_entry(logctx, (AVExifMetadata *) ifd, extra_tag, 0, &extra_entry);
803
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 672 times.
 672 if (ret < 0)
804 ✗ break;
805
2/2
✓ Branch 0 taken 665 times.
✓ Branch 1 taken 7 times.
 672 if (!ret)
806 665 continue;
807 7 av_log(logctx, AV_LOG_DEBUG, "found extra IFD tag: %04x\n", extra_tag);
808
2/2
✓ Branch 0 taken 5 times.
✓ Branch 1 taken 2 times.
 7 if (!ifd_new) {
809 5 ifd_new = av_exif_clone_ifd(ifd);
810
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 5 times.
 5 if (!ifd_new)
811 ✗ break;
812 5 ifd = ifd_new;
813 }
814 /* calling remove_entry will call av_exif_free on the original */
815 7 AVExifMetadata *cloned = av_exif_clone_ifd(&extra_entry->value.ifd);
816
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (!cloned)
817 ✗ break;
818 7 extra_ifds[extras++] = *cloned;
819 /* don't use av_exif_free here, we want to preserve internals */
820 7 av_free(cloned);
821 7 ret = av_exif_remove_entry(logctx, ifd_new, extra_tag, 0);
822
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (ret < 0)
823 ✗ break;
824 }
825
826
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (ret < 0) {
827 ✗ av_log(logctx, AV_LOG_ERROR, "error popping additional IFD: %s\n", av_err2str(ret));
828 ✗ goto end;
829 }
830
831 42 next = bytestream2_tell_p(&pb);
832 42 ret = exif_write_ifd(logctx, &pb, le, 0, ifd);
833
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (ret < 0) {
834 ✗ av_log(logctx, AV_LOG_ERROR, "error writing EXIF data: %s\n", av_err2str(ret));
835 ✗ goto end;
836 }
837 42 next += ret;
838
839
2/2
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 42 times.
 49 for (int i = 0; i < extras; i++) {
840 7 av_log(logctx, AV_LOG_DEBUG, "writing additional ifd at: %d\n", next);
841 /* exif_write_ifd always writes 0 i.e. last ifd so we overwrite that here */
842 7 bytestream2_seek_p(&pb, -4, SEEK_CUR);
843 7 tput32(&pb, le, next);
844 7 bytestream2_seek_p(&pb, next, SEEK_SET);
845 7 ret = exif_write_ifd(logctx, &pb, le, 0, &extra_ifds[i]);
846
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (ret < 0) {
847 ✗ av_log(logctx, AV_LOG_ERROR, "error writing additional IFD: %s\n", av_err2str(ret));
848 ✗ goto end;
849 }
850 7 next += ret;
851 }
852
853 /* shrink the buffer to the amount of data we actually used */
854 /* extras don't contribute the initial BASE_TAG_SIZE each */
855 42 ret = av_buffer_realloc(&buf, buf->size - BASE_TAG_SIZE * extras);
856
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (ret < 0)
857 ✗ goto end;
858
859 42 *buffer = buf;
860 42 ret = 0;
861
862 42 end:
863 42 av_exif_free(ifd_new);
864 42 av_freep(&ifd_new);
865
2/2
✓ Branch 0 taken 672 times.
✓ Branch 1 taken 42 times.
 714 for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++)
866 672 av_exif_free(&extra_ifds[i]);
867
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 42 times.
 42 if (ret < 0)
868 ✗ av_buffer_unref(&buf);
869
870 42 return ret;
871 }
872
873 75 int av_exif_parse_buffer(void *logctx, const uint8_t *buf, size_t size,
874 AVExifMetadata *ifd, enum AVExifHeaderMode header_mode)
875 {
876 int ret, le;
877 GetByteContext gbytes;
878
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 75 times.
 75 if (size > INT_MAX)
879 ✗ return AVERROR(EINVAL);
880 75 size_t off = 0;
881
2/6
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
✓ Branch 2 taken 73 times.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 75 switch (header_mode) {
882 ✗ case AV_EXIF_EXIF00:
883 ✗ if (size < 6)
884 ✗ return AVERROR_INVALIDDATA;
885 ✗ off = 6;
886 /* fallthrough */
887 2 case AV_EXIF_T_OFF:
888
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (size < 4)
889 ✗ return AVERROR_INVALIDDATA;
890
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (!off)
891 2 off = AV_RB32(buf) + 4;
892 /* fallthrough */
893 case AV_EXIF_TIFF_HEADER: {
894 int ifd_offset;
895
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 75 times.
 75 if (size <= off)
896 ✗ return AVERROR_INVALIDDATA;
897 75 bytestream2_init(&gbytes, buf + off, size - off);
898 // read TIFF header
899 75 ret = ff_tdecode_header(&gbytes, &le, &ifd_offset);
900
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 75 times.
 75 if (ret < 0) {
901 ✗ av_log(logctx, AV_LOG_ERROR, "invalid TIFF header in EXIF data: %s\n", av_err2str(ret));
902 ✗ return ret;
903 }
904 75 bytestream2_seek(&gbytes, ifd_offset, SEEK_SET);
905 75 break;
906 }
907 ✗ case AV_EXIF_ASSUME_LE:
908 ✗ le = 1;
909 ✗ bytestream2_init(&gbytes, buf, size);
910 ✗ break;
911 ✗ case AV_EXIF_ASSUME_BE:
912 ✗ le = 0;
913 ✗ bytestream2_init(&gbytes, buf, size);
914 ✗ break;
915 ✗ default:
916 ✗ return AVERROR(EINVAL);
917 }
918
919 /*
920 * parse IFD0 here. If the return value is positive that tells us
921 * there is subimage metadata, but we don't parse that IFD here
922 */
923 75 ret = exif_parse_ifd_list(logctx, &gbytes, le, 0, ifd, 0);
924
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 75 times.
 75 if (ret < 0) {
925 ✗ av_log(logctx, AV_LOG_ERROR, "error decoding EXIF data: %s\n", av_err2str(ret));
926 ✗ return ret;
927 }
928
2/2
✓ Branch 0 taken 66 times.
✓ Branch 1 taken 9 times.
 75 if (!ret)
929 66 goto finish;
930 9 int next = ret;
931 9 bytestream2_seek(&gbytes, next, SEEK_SET);
932
933 /* cap at 16 extra IFDs for sanity/parse security */
934
1/2
✓ Branch 0 taken 12 times.
✗ Branch 1 not taken.
 12 for (int extra_tag = 0xFFFCu; extra_tag > 0xFFECu; extra_tag--) {
935 12 AVExifMetadata extra_ifd = { 0 };
936 12 ret = exif_parse_ifd_list(logctx, &gbytes, le, 0, &extra_ifd, 1);
937
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (ret < 0) {
938 ✗ av_exif_free(&extra_ifd);
939 9 break;
940 }
941 12 next = ret;
942 12 av_log(logctx, AV_LOG_DEBUG, "found extra IFD: %04x with next=%d\n", extra_tag, ret);
943 12 bytestream2_seek(&gbytes, next, SEEK_SET);
944 12 ret = av_exif_set_entry(logctx, ifd, extra_tag, AV_TIFF_IFD, 1, NULL, 0, &extra_ifd);
945 12 av_exif_free(&extra_ifd);
946
4/6
✓ Branch 0 taken 12 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✓ Branch 3 taken 9 times.
✓ Branch 5 taken 3 times.
✗ Branch 6 not taken.
 12 if (ret < 0 || !next || bytestream2_get_bytes_left(&gbytes) <= 0)
947 break;
948 }
949
950 ✗ finish:
951 75 return bytestream2_tell(&gbytes) + off;
952 }
953
954 #define COLUMN_SEP(i, c) ((i) ? ((i) % (c) ? ", " : "\n") : "")
955
956 59 static int exif_ifd_to_dict(void *logctx, const char *prefix, const AVExifMetadata *ifd, AVDictionary **metadata)
957 {
958 AVBPrint bp;
959 59 int ret = 0;
960 59 char *key = NULL;
961 59 char *value = NULL;
962
963
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 59 times.
 59 if (!prefix)
964 ✗ prefix = "";
965
966
2/2
✓ Branch 0 taken 930 times.
✓ Branch 1 taken 59 times.
 989 for (uint16_t i = 0; i < ifd->count; i++) {
967 930 const AVExifEntry *entry = &ifd->entries[i];
968 930 const char *name = av_exif_get_tag_name(entry->id);
969 930 av_bprint_init(&bp, entry->count * 10, AV_BPRINT_SIZE_UNLIMITED);
970
2/2
✓ Branch 0 taken 472 times.
✓ Branch 1 taken 458 times.
 930 if (*prefix)
971 472 av_bprintf(&bp, "%s/", prefix);
972
2/2
✓ Branch 0 taken 642 times.
✓ Branch 1 taken 288 times.
 930 if (name)
973 642 av_bprintf(&bp, "%s", name);
974 else
975 288 av_bprintf(&bp, "0x%04X", entry->id);
976 930 ret = av_bprint_finalize(&bp, &key);
977
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 930 times.
 930 if (ret < 0)
978 ✗ goto end;
979 930 av_bprint_init(&bp, entry->count * 10, AV_BPRINT_SIZE_UNLIMITED);
980
6/9
✓ Branch 0 taken 21 times.
✓ Branch 1 taken 624 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 134 times.
✓ Branch 4 taken 10 times.
✓ Branch 5 taken 65 times.
✓ Branch 6 taken 76 times.
✗ Branch 7 not taken.
✗ Branch 8 not taken.
 930 switch (entry->type) {
981 21 case AV_TIFF_IFD:
982 21 ret = exif_ifd_to_dict(logctx, key, &entry->value.ifd, metadata);
983
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
 21 if (ret < 0)
984 ✗ goto end;
985 21 break;
986 624 case AV_TIFF_SHORT:
987 case AV_TIFF_LONG:
988
2/2
✓ Branch 0 taken 3715 times.
✓ Branch 1 taken 624 times.
 4339 for (uint32_t j = 0; j < entry->count; j++)
989
4/4
✓ Branch 0 taken 3091 times.
✓ Branch 1 taken 624 times.
✓ Branch 2 taken 2743 times.
✓ Branch 3 taken 348 times.
 3715 av_bprintf(&bp, "%s%7" PRIu32, COLUMN_SEP(j, 8), (uint32_t)entry->value.uint[j]);
990 624 break;
991 ✗ case AV_TIFF_SSHORT:
992 case AV_TIFF_SLONG:
993 ✗ for (uint32_t j = 0; j < entry->count; j++)
994 ✗ av_bprintf(&bp, "%s%7" PRId32, COLUMN_SEP(j, 8), (int32_t)entry->value.sint[j]);
995 ✗ break;
996 134 case AV_TIFF_RATIONAL:
997 case AV_TIFF_SRATIONAL:
998
2/2
✓ Branch 0 taken 187 times.
✓ Branch 1 taken 134 times.
 321 for (uint32_t j = 0; j < entry->count; j++)
999
4/4
✓ Branch 0 taken 53 times.
✓ Branch 1 taken 134 times.
✓ Branch 2 taken 44 times.
✓ Branch 3 taken 9 times.
 187 av_bprintf(&bp, "%s%7i:%-7i", COLUMN_SEP(j, 4), entry->value.rat[j].num, entry->value.rat[j].den);
1000 134 break;
1001 10 case AV_TIFF_DOUBLE:
1002 case AV_TIFF_FLOAT:
1003
2/2
✓ Branch 0 taken 34 times.
✓ Branch 1 taken 10 times.
 44 for (uint32_t j = 0; j < entry->count; j++)
1004
3/4
✓ Branch 0 taken 24 times.
✓ Branch 1 taken 10 times.
✓ Branch 2 taken 24 times.
✗ Branch 3 not taken.
 34 av_bprintf(&bp, "%s%.15g", COLUMN_SEP(j, 4), entry->value.dbl[j]);
1005 10 break;
1006 65 case AV_TIFF_STRING:
1007 65 av_bprintf(&bp, "%s", entry->value.str);
1008 65 break;
1009 76 case AV_TIFF_UNDEFINED:
1010 case AV_TIFF_BYTE:
1011
2/2
✓ Branch 0 taken 27795 times.
✓ Branch 1 taken 76 times.
 27871 for (uint32_t j = 0; j < entry->count; j++)
1012
4/4
✓ Branch 0 taken 27719 times.
✓ Branch 1 taken 76 times.
✓ Branch 2 taken 26012 times.
✓ Branch 3 taken 1707 times.
 27795 av_bprintf(&bp, "%s%3i", COLUMN_SEP(j, 16), entry->value.ubytes[j]);
1013 76 break;
1014 ✗ case AV_TIFF_SBYTE:
1015 ✗ for (uint32_t j = 0; j < entry->count; j++)
1016 ✗ av_bprintf(&bp, "%s%3i", COLUMN_SEP(j, 16), entry->value.sbytes[j]);
1017 ✗ break;
1018 }
1019
2/2
✓ Branch 0 taken 909 times.
✓ Branch 1 taken 21 times.
 930 if (entry->type != AV_TIFF_IFD) {
1020
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 909 times.
 909 if (!av_bprint_is_complete(&bp)) {
1021 ✗ av_bprint_finalize(&bp, NULL);
1022 ✗ ret = AVERROR(ENOMEM);
1023 ✗ goto end;
1024 }
1025 909 ret = av_bprint_finalize(&bp, &value);
1026
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 909 times.
 909 if (ret < 0)
1027 ✗ goto end;
1028 909 ret = av_dict_set(metadata, key, value, AV_DICT_DONT_STRDUP_KEY | AV_DICT_DONT_STRDUP_VAL);
1029 909 key = NULL;
1030 909 value = NULL;
1031
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 909 times.
 909 if (ret < 0)
1032 ✗ goto end;
1033 } else {
1034 21 av_freep(&key);
1035 }
1036 }
1037
1038 59 end:
1039 59 av_freep(&key);
1040 59 av_freep(&value);
1041 59 return ret;
1042 }
1043
1044 38 int av_exif_ifd_to_dict(void *logctx, const AVExifMetadata *ifd, AVDictionary **metadata)
1045 {
1046 38 return exif_ifd_to_dict(logctx, "", ifd, metadata);
1047 }
1048
1049 #if LIBAVCODEC_VERSION_MAJOR < 63
1050 ✗ int avpriv_exif_decode_ifd(void *logctx, const uint8_t *buf, int size,
1051 int le, int depth, AVDictionary **metadata)
1052 {
1053 ✗ AVExifMetadata ifd = { 0 };
1054 GetByteContext gb;
1055 int ret;
1056 ✗ bytestream2_init(&gb, buf, size);
1057 ✗ ret = exif_parse_ifd_list(logctx, &gb, le, depth, &ifd, 0);
1058 ✗ if (ret < 0)
1059 ✗ return ret;
1060 ✗ ret = av_exif_ifd_to_dict(logctx, &ifd, metadata);
1061 ✗ av_exif_free(&ifd);
1062 ✗ return ret;
1063 }
1064 #endif
1065
1066 #define EXIF_COPY(fname, srcname) do { \
1067 size_t sz; \
1068 if (av_size_mult(src->count, sizeof(*(fname)), &sz) < 0) { \
1069 ret = AVERROR(ENOMEM); \
1070 goto end; \
1071 } \
1072 (fname) = av_memdup((srcname), sz); \
1073 if (!(fname)) { \
1074 ret = AVERROR(ENOMEM); \
1075 goto end; \
1076 } \
1077 } while (0)
1078
1079 1423 static int exif_clone_entry(AVExifEntry *dst, const AVExifEntry *src)
1080 {
1081 1423 int ret = 0;
1082
1083 1423 memset(dst, 0, sizeof(*dst));
1084
1085 1423 dst->count = src->count;
1086 1423 dst->id = src->id;
1087 1423 dst->type = src->type;
1088
1089 1423 dst->ifd_offset = src->ifd_offset;
1090
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 1421 times.
 1423 if (src->ifd_lead) {
1091 2 dst->ifd_lead = av_memdup(src->ifd_lead, src->ifd_offset);
1092
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!dst->ifd_lead) {
1093 ✗ ret = AVERROR(ENOMEM);
1094 ✗ goto end;
1095 }
1096 } else {
1097 1421 dst->ifd_lead = NULL;
1098 }
1099
1100
6/9
✓ Branch 0 taken 50 times.
✓ Branch 1 taken 886 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 210 times.
✓ Branch 4 taken 10 times.
✓ Branch 5 taken 150 times.
✗ Branch 6 not taken.
✓ Branch 7 taken 117 times.
✗ Branch 8 not taken.
 1423 switch(src->type) {
1101 50 case AV_TIFF_IFD: {
1102 50 AVExifMetadata *cloned = av_exif_clone_ifd(&src->value.ifd);
1103
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 50 times.
 50 if (!cloned) {
1104 ✗ ret = AVERROR(ENOMEM);
1105 ✗ goto end;
1106 }
1107 50 dst->value.ifd = *cloned;
1108 50 av_freep(&cloned);
1109 50 break;
1110 }
1111 886 case AV_TIFF_SHORT:
1112 case AV_TIFF_LONG:
1113
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 886 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 886 times.
 886 EXIF_COPY(dst->value.uint, src->value.uint);
1114 886 break;
1115 ✗ case AV_TIFF_SLONG:
1116 case AV_TIFF_SSHORT:
1117 ✗ EXIF_COPY(dst->value.sint, src->value.sint);
1118 ✗ break;
1119 210 case AV_TIFF_RATIONAL:
1120 case AV_TIFF_SRATIONAL:
1121
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 210 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 210 times.
 210 EXIF_COPY(dst->value.rat, src->value.rat);
1122 210 break;
1123 10 case AV_TIFF_DOUBLE:
1124 case AV_TIFF_FLOAT:
1125
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 10 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 10 times.
 10 EXIF_COPY(dst->value.dbl, src->value.dbl);
1126 10 break;
1127 150 case AV_TIFF_BYTE:
1128 case AV_TIFF_UNDEFINED:
1129
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 150 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 150 times.
 150 EXIF_COPY(dst->value.ubytes, src->value.ubytes);
1130 150 break;
1131 ✗ case AV_TIFF_SBYTE:
1132 ✗ EXIF_COPY(dst->value.sbytes, src->value.sbytes);
1133 ✗ break;
1134 117 case AV_TIFF_STRING:
1135 117 dst->value.str = av_memdup(src->value.str, src->count+1);
1136
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 117 times.
 117 if (!dst->value.str) {
1137 ✗ ret = AVERROR(ENOMEM);
1138 ✗ goto end;
1139 }
1140 117 break;
1141 }
1142
1143 1423 return 0;
1144
1145 ✗ end:
1146 ✗ av_freep(&dst->ifd_lead);
1147 ✗ if (src->type == AV_TIFF_IFD)
1148 ✗ av_exif_free(&dst->value.ifd);
1149 else
1150 ✗ av_freep(&dst->value.ptr);
1151 ✗ memset(dst, 0, sizeof(*dst));
1152
1153 ✗ return ret;
1154 }
1155
1156 703 static int exif_get_entry(void *logctx, AVExifMetadata *ifd, uint16_t id, int depth, AVExifEntry **value)
1157 {
1158 703 int offset = 1;
1159
1160
5/8
✓ Branch 0 taken 703 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 701 times.
✓ Branch 3 taken 2 times.
✓ Branch 4 taken 701 times.
✗ Branch 5 not taken.
✗ Branch 6 not taken.
✓ Branch 7 taken 703 times.
 703 if (!ifd || ifd->count && !ifd->entries || !value)
1161 ✗ return AVERROR(EINVAL);
1162
1163
2/2
✓ Branch 0 taken 7941 times.
✓ Branch 1 taken 695 times.
 8636 for (size_t i = 0; i < ifd->count; i++) {
1164
2/2
✓ Branch 0 taken 8 times.
✓ Branch 1 taken 7933 times.
 7941 if (ifd->entries[i].id == id) {
1165 8 *value = &ifd->entries[i];
1166 8 return i + offset;
1167 }
1168
2/2
✓ Branch 0 taken 212 times.
✓ Branch 1 taken 7721 times.
 7933 if (ifd->entries[i].type == AV_TIFF_IFD) {
1169
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 212 times.
 212 if (depth < 3) {
1170 ✗ int ret = exif_get_entry(logctx, &ifd->entries[i].value.ifd, id, depth + 1, value);
1171 ✗ if (ret)
1172 ✗ return ret < 0 ? ret : ret + offset;
1173 }
1174 212 offset += ifd->entries[i].value.ifd.count;
1175 }
1176 }
1177
1178 695 return 0;
1179 }
1180
1181 703 int av_exif_get_entry(void *logctx, AVExifMetadata *ifd, uint16_t id, int flags, AVExifEntry **value)
1182 {
1183
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 703 times.
 703 return exif_get_entry(logctx, ifd, id, (flags & AV_EXIF_FLAG_RECURSIVE) ? 0 : INT_MAX, value);
1184 }
1185
1186 27 int av_exif_set_entry(void *logctx, AVExifMetadata *ifd, uint16_t id, enum AVTiffDataType type,
1187 uint32_t count, const uint8_t *ifd_lead, uint32_t ifd_offset, const void *value)
1188 {
1189 void *temp;
1190 27 int ret = 0;
1191 27 AVExifEntry *entry = NULL;
1192 27 AVExifEntry src = { 0 };
1193
1194
4/6
✓ Branch 0 taken 27 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 25 times.
✓ Branch 3 taken 2 times.
✓ Branch 4 taken 25 times.
✗ Branch 5 not taken.
 27 if (!ifd || ifd->count && !ifd->entries
1195
3/8
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 27 times.
✗ Branch 5 not taken.
✓ Branch 6 taken 27 times.
✗ Branch 7 not taken.
 27 || ifd_lead && !ifd_offset || !ifd_lead && ifd_offset
1196
2/4
✓ Branch 0 taken 27 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 27 times.
 27 || !value || ifd->count == 0xFFFFu)
1197 ✗ return AVERROR(EINVAL);
1198
1199 27 ret = av_exif_get_entry(logctx, ifd, id, 0, &entry);
1200
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
 27 if (ret < 0)
1201 ✗ return ret;
1202
1203
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
 27 if (entry) {
1204 ✗ exif_free_entry(entry);
1205 } else {
1206 size_t required_size;
1207 27 ret = av_size_mult(ifd->count + 1, sizeof(*ifd->entries), &required_size);
1208
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
 27 if (ret < 0)
1209 ✗ return AVERROR(ENOMEM);
1210 27 temp = av_fast_realloc(ifd->entries, &ifd->size, required_size);
1211
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
 27 if (!temp)
1212 ✗ return AVERROR(ENOMEM);
1213 27 ifd->entries = temp;
1214 27 entry = &ifd->entries[ifd->count++];
1215 }
1216
1217 27 src.count = count;
1218 27 src.id = id;
1219 27 src.type = type;
1220 27 src.ifd_lead = (uint8_t *) ifd_lead;
1221 27 src.ifd_offset = ifd_offset;
1222
2/2
✓ Branch 0 taken 14 times.
✓ Branch 1 taken 13 times.
 27 if (type == AV_TIFF_IFD)
1223 14 src.value.ifd = * (const AVExifMetadata *) value;
1224 else
1225 13 src.value.ptr = (void *) value;
1226
1227 27 ret = exif_clone_entry(entry, &src);
1228
1229
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 27 times.
 27 if (ret < 0)
1230 ✗ ifd->count--;
1231
1232 27 return ret;
1233 }
1234
1235 28 static int exif_remove_entry(void *logctx, AVExifMetadata *ifd, uint16_t id, int depth)
1236 {
1237 28 int32_t index = -1;
1238 28 int ret = 0;
1239
1240
3/6
✓ Branch 0 taken 28 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 28 times.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 28 times.
 28 if (!ifd || ifd->count && !ifd->entries)
1241 ✗ return AVERROR(EINVAL);
1242
1243
1/2
✓ Branch 0 taken 209 times.
✗ Branch 1 not taken.
 209 for (size_t i = 0; i < ifd->count; i++) {
1244
2/2
✓ Branch 0 taken 28 times.
✓ Branch 1 taken 181 times.
 209 if (ifd->entries[i].id == id) {
1245 28 index = i;
1246 28 break;
1247 }
1248
3/4
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 174 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 7 times.
 181 if (ifd->entries[i].type == AV_TIFF_IFD && depth < 3) {
1249 ✗ ret = exif_remove_entry(logctx, &ifd->entries[i].value.ifd, id, depth + 1);
1250 ✗ if (ret)
1251 ✗ return ret;
1252 }
1253 }
1254
1255
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 28 times.
 28 if (index < 0)
1256 ✗ return 0;
1257 28 exif_free_entry(&ifd->entries[index]);
1258
1259
2/2
✓ Branch 0 taken 5 times.
✓ Branch 1 taken 23 times.
 28 if (index == --ifd->count) {
1260
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 5 times.
 5 if (!index)
1261 ✗ av_freep(&ifd->entries);
1262 5 return 1;
1263 }
1264
1265 23 memmove(&ifd->entries[index], &ifd->entries[index + 1], (ifd->count - index) * sizeof(*ifd->entries));
1266
1267 23 return 1 + (ifd->count - index);
1268 }
1269
1270 28 int av_exif_remove_entry(void *logctx, AVExifMetadata *ifd, uint16_t id, int flags)
1271 {
1272
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 28 times.
 28 return exif_remove_entry(logctx, ifd, id, (flags & AV_EXIF_FLAG_RECURSIVE) ? 0 : INT_MAX);
1273 }
1274
1275 81 AVExifMetadata *av_exif_clone_ifd(const AVExifMetadata *ifd)
1276 {
1277 81 AVExifMetadata *ret = av_mallocz(sizeof(*ret));
1278
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 81 times.
 81 if (!ret)
1279 ✗ return NULL;
1280
1281 81 ret->count = ifd->count;
1282
2/2
✓ Branch 0 taken 79 times.
✓ Branch 1 taken 2 times.
 81 if (ret->count) {
1283 size_t required_size;
1284
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 79 times.
 79 if (av_size_mult(ret->count, sizeof(*ret->entries), &required_size) < 0)
1285 ✗ goto fail;
1286 79 av_fast_mallocz(&ret->entries, &ret->size, required_size);
1287
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 79 times.
 79 if (!ret->entries)
1288 ✗ goto fail;
1289 }
1290
1291
2/2
✓ Branch 0 taken 1396 times.
✓ Branch 1 taken 81 times.
 1477 for (size_t i = 0; i < ret->count; i++) {
1292 1396 const AVExifEntry *entry = &ifd->entries[i];
1293 1396 AVExifEntry *ret_entry = &ret->entries[i];
1294 1396 int status = exif_clone_entry(ret_entry, entry);
1295
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1396 times.
 1396 if (status < 0)
1296 ✗ goto fail;
1297 }
1298
1299 81 return ret;
1300
1301 ✗ fail:
1302 ✗ av_exif_free(ret);
1303 ✗ av_free(ret);
1304 ✗ return NULL;
1305 }
1306
1307 static const int rotation_lut[2][4] = {
1308 {1, 8, 3, 6}, {4, 7, 2, 5},
1309 };
1310
1311 2 int av_exif_matrix_to_orientation(const int32_t *matrix)
1312 {
1313 2 double rotation = av_display_rotation_get(matrix);
1314 // determinant
1315 2 int vflip = ((int64_t)matrix[0] * (int64_t)matrix[4]
1316 2 - (int64_t)matrix[1] * (int64_t)matrix[3]) < 0;
1317
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!isfinite(rotation))
1318 ✗ return 0;
1319 2 int rot = (int)(rotation + 0.5);
1320 2 rot = (((rot % 360) + 360) % 360) / 90;
1321 2 return rotation_lut[vflip][rot];
1322 }
1323
1324 18 int av_exif_orientation_to_matrix(int32_t *matrix, int orientation)
1325 {
1326
2/9
✓ Branch 0 taken 14 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 4 times.
✗ Branch 5 not taken.
✗ Branch 6 not taken.
✗ Branch 7 not taken.
✗ Branch 8 not taken.
 18 switch (orientation) {
1327 14 case 1:
1328 14 av_display_rotation_set(matrix, 0.0);
1329 14 break;
1330 ✗ case 2:
1331 ✗ av_display_rotation_set(matrix, 0.0);
1332 ✗ av_display_matrix_flip(matrix, 1, 0);
1333 ✗ break;
1334 ✗ case 3:
1335 ✗ av_display_rotation_set(matrix, 180.0);
1336 ✗ break;
1337 ✗ case 4:
1338 ✗ av_display_rotation_set(matrix, 180.0);
1339 ✗ av_display_matrix_flip(matrix, 1, 0);
1340 ✗ break;
1341 4 case 5:
1342 4 av_display_rotation_set(matrix, 90.0);
1343 4 av_display_matrix_flip(matrix, 1, 0);
1344 4 break;
1345 ✗ case 6:
1346 ✗ av_display_rotation_set(matrix, 90.0);
1347 ✗ break;
1348 ✗ case 7:
1349 ✗ av_display_rotation_set(matrix, -90.0);
1350 ✗ av_display_matrix_flip(matrix, 1, 0);
1351 ✗ break;
1352 ✗ case 8:
1353 ✗ av_display_rotation_set(matrix, -90.0);
1354 ✗ break;
1355 ✗ default:
1356 ✗ return AVERROR(EINVAL);
1357 }
1358
1359 18 return 0;
1360 }
1361
1362 3 int ff_exif_sanitize_ifd(void *logctx, const AVFrame *frame, AVExifMetadata *ifd)
1363 {
1364 3 int ret = 0;
1365 3 AVFrameSideData *sd_orient = NULL;
1366 3 AVExifEntry *or = NULL;
1367 3 AVExifEntry *iw = NULL;
1368 3 AVExifEntry *ih = NULL;
1369 3 AVExifEntry *pw = NULL;
1370 3 AVExifEntry *ph = NULL;
1371 3 uint64_t orientation = 1;
1372 3 uint64_t w = frame->width;
1373 3 uint64_t h = frame->height;
1374 3 int rewrite = 0;
1375
1376 3 sd_orient = av_frame_get_side_data(frame, AV_FRAME_DATA_DISPLAYMATRIX);
1377
1378
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 if (sd_orient)
1379 1 orientation = av_exif_matrix_to_orientation((int32_t *) sd_orient->data);
1380
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 if (orientation != 1)
1381 1 av_log(logctx, AV_LOG_DEBUG, "matrix contains nontrivial EXIF orientation: %" PRIu64 "\n", orientation);
1382
1383
2/2
✓ Branch 0 taken 9 times.
✓ Branch 1 taken 3 times.
 12 for (size_t i = 0; i < ifd->count; i++) {
1384 9 AVExifEntry *entry = &ifd->entries[i];
1385
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 9 if (entry->id == ORIENTATION_TAG && entry->count > 0 && entry->type == AV_TIFF_SHORT) {
1386 ✗ or = entry;
1387 ✗ continue;
1388 }
1389
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 9 if (entry->id == IMAGE_WIDTH_TAG && entry->count > 0 && entry->type == AV_TIFF_LONG) {
1390 ✗ iw = entry;
1391 ✗ continue;
1392 }
1393
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 9 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 9 if (entry->id == IMAGE_LENGTH_TAG && entry->count > 0 && entry->type == AV_TIFF_LONG) {
1394 ✗ ih = entry;
1395 ✗ continue;
1396 }
1397
3/4
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 8 times.
✓ Branch 2 taken 1 times.
✗ Branch 3 not taken.
 9 if (entry->id == EXIFIFD_TAG && entry->type == AV_TIFF_IFD) {
1398 1 AVExifMetadata *exif = &entry->value.ifd;
1399
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 1 times.
 2 for (size_t j = 0; j < exif->count; j++) {
1400 1 AVExifEntry *exifentry = &exif->entries[j];
1401
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 1 if (exifentry->id == PIXEL_X_TAG && exifentry->count > 0 && exifentry->type == AV_TIFF_SHORT) {
1402 ✗ pw = exifentry;
1403 ✗ continue;
1404 }
1405
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 1 if (exifentry->id == PIXEL_Y_TAG && exifentry->count > 0 && exifentry->type == AV_TIFF_SHORT) {
1406 ✗ ph = exifentry;
1407 ✗ continue;
1408 }
1409 }
1410 }
1411 }
1412
1413
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 3 if (or && or->value.uint[0] != orientation) {
1414 ✗ rewrite = 1;
1415 ✗ or->value.uint[0] = orientation;
1416 }
1417
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 3 if (iw && iw->value.uint[0] != w) {
1418 ✗ rewrite = 1;
1419 ✗ iw->value.uint[0] = w;
1420 }
1421
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 3 if (ih && ih->value.uint[0] != h) {
1422 ✗ rewrite = 1;
1423 ✗ ih->value.uint[0] = h;
1424 }
1425
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 3 if (pw && pw->value.uint[0] != w) {
1426 ✗ rewrite = 1;
1427 ✗ pw->value.uint[0] = w;
1428 }
1429
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 3 if (ph && ph->value.uint[0] != h) {
1430 ✗ rewrite = 1;
1431 ✗ ph->value.uint[0] = h;
1432 }
1433
3/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 1 times.
✓ Branch 3 taken 2 times.
 3 if (!or && orientation != 1) {
1434 1 rewrite = 1;
1435 1 ret = av_exif_set_entry(logctx, ifd, ORIENTATION_TAG, AV_TIFF_SHORT, 1, NULL, 0, &orientation);
1436
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
 1 if (ret < 0)
1437 ✗ goto end;
1438 }
1439
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
 3 if (!iw && w) {
1440 3 rewrite = 1;
1441 3 ret = av_exif_set_entry(logctx, ifd, IMAGE_WIDTH_TAG, AV_TIFF_LONG, 1, NULL, 0, &w);
1442
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1443 ✗ goto end;
1444 }
1445
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
 3 if (!ih && h) {
1446 3 rewrite = 1;
1447 3 ret = av_exif_set_entry(logctx, ifd, IMAGE_LENGTH_TAG, AV_TIFF_LONG, 1, NULL, 0, &h);
1448
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1449 ✗ goto end;
1450 }
1451
3/12
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 3 times.
✗ Branch 6 not taken.
✗ Branch 7 not taken.
✗ Branch 8 not taken.
✗ Branch 9 not taken.
✗ Branch 10 not taken.
✗ Branch 11 not taken.
 3 if (!pw && w && w < 0xFFFFu || !ph && h && h < 0xFFFFu) {
1452 AVExifMetadata *exif;
1453 AVExifEntry *exif_entry;
1454 3 int exif_found = av_exif_get_entry(logctx, ifd, EXIFIFD_TAG, 0, &exif_entry);
1455 3 rewrite = 1;
1456
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (exif_found < 0)
1457 ✗ goto end;
1458
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 if (exif_found > 0) {
1459 1 exif = &exif_entry->value.ifd;
1460 } else {
1461 2 AVExifMetadata exif_new = { 0 };
1462 2 ret = av_exif_set_entry(logctx, ifd, EXIFIFD_TAG, AV_TIFF_IFD, 1, NULL, 0, &exif_new);
1463
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0) {
1464 ✗ av_exif_free(&exif_new);
1465 ✗ goto end;
1466 }
1467 2 exif = &ifd->entries[ifd->count - 1].value.ifd;
1468 }
1469
3/6
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 3 times.
✗ Branch 5 not taken.
 3 if (!pw && w && w < 0xFFFFu) {
1470 3 ret = av_exif_set_entry(logctx, exif, PIXEL_X_TAG, AV_TIFF_SHORT, 1, NULL, 0, &w);
1471
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1472 ✗ goto end;
1473 }
1474
3/6
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 3 times.
✗ Branch 5 not taken.
 3 if (!ph && h && h < 0xFFFFu) {
1475 3 ret = av_exif_set_entry(logctx, exif, PIXEL_Y_TAG, AV_TIFF_SHORT, 1, NULL, 0, &h);
1476
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1477 ✗ goto end;
1478 }
1479 }
1480
1481 3 return rewrite;
1482
1483 ✗ end:
1484 ✗ return ret;
1485 }
1486
1487 249 int ff_exif_get_buffer(void *logctx, const AVFrame *frame, AVBufferRef **buffer_ptr, enum AVExifHeaderMode header_mode)
1488 {
1489 249 AVFrameSideData *sd_exif = NULL;
1490 249 AVBufferRef *buffer = NULL;
1491 249 AVExifMetadata ifd = { 0 };
1492 249 int ret = 0;
1493 249 int rewrite = 0;
1494
1495
2/4
✓ Branch 0 taken 249 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 249 times.
 249 if (!buffer_ptr || *buffer_ptr)
1496 ✗ return AVERROR(EINVAL);
1497
1498 249 sd_exif = av_frame_get_side_data(frame, AV_FRAME_DATA_EXIF);
1499
2/2
✓ Branch 0 taken 246 times.
✓ Branch 1 taken 3 times.
 249 if (!sd_exif)
1500 246 return 0;
1501
1502 3 ret = av_exif_parse_buffer(logctx, sd_exif->data, sd_exif->size, &ifd, AV_EXIF_TIFF_HEADER);
1503
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1504 ✗ goto end;
1505
1506 3 rewrite = ff_exif_sanitize_ifd(logctx, frame, &ifd);
1507
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (rewrite < 0) {
1508 ✗ ret = rewrite;
1509 ✗ goto end;
1510 }
1511
1512
1/2
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
 3 if (rewrite) {
1513 3 ret = av_exif_write(logctx, &ifd, &buffer, header_mode);
1514
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if (ret < 0)
1515 ✗ goto end;
1516
1517 3 *buffer_ptr = buffer;
1518 } else {
1519 ✗ *buffer_ptr = av_buffer_ref(sd_exif->buf);
1520 ✗ if (!*buffer_ptr) {
1521 ✗ ret = AVERROR(ENOMEM);
1522 ✗ goto end;
1523 }
1524 }
1525
1526 3 av_exif_free(&ifd);
1527 3 return rewrite;
1528
1529 ✗ end:
1530 ✗ av_exif_free(&ifd);
1531 ✗ return ret;
1532 }
1533