CVE-2019-9143: Uncontrolled recursion loop in Exiv2::Image::printTiffStructure() - exiv2-0.27

   do {
           // Read top of directory
           const int seekSuccess = !io.seek(start,BasicIo::beg);
           const long bytesRead = io.read(dir.pData_, 2);
           if (!seekSuccess || bytesRead == 0) {
               throw Error(kerCorruptedMetadata);
           }
           uint16_t   dirLength = byteSwap2(dir,0,bSwap);            bool tooBig = dirLength > 500;
           if ( tooBig ) {
               out << Internal::indent(depth) << "dirLength = " << dirLength << std::endl;
               throw Error(kerTiffDirectoryTooLarge);
           }            if ( bFirst && bPrint ) {
               out << Internal::indent(depth) << Internal::stringFormat("STRUCTURE OF TIFF FILE (%c%c): ",c,c) << io.path() << std::endl;
  

84    ../sysdeps/unix/syscall-template.S: No such file or directory.
[ Legend: Modified register | Code | Heap | Stack | String ]
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax   : 0x49              
$rbx   : 0x4a              
$rcx   : 0x00007ffff5c172c0  →   cmp rax, 0xfffffffffffff001
$rdx   : 0x4a              
$rsp   : 0x00007fffffffd338  →  0x00007ffff5b98bff  →   test rax, rax
$rbp   : 0x0000619000001480  →  "STRUCTURE OF TIFF FILE (II): id:000000,src:000553+[...]"
$rsi   : 0x0000619000001480  →  "STRUCTURE OF TIFF FILE (II): id:000000,src:000553+[...]"
$rdi   : 0x1               
$rip   : 0x00007ffff5c172c0  →   cmp rax, 0xfffffffffffff001
$r8    : 0x00007ffff5ee6780  →  0x0000000100000001  →  0x0000000000000000
$r9    : 0x00007ffff7fd1780  →  0x00007ffff7fd1780  →  [loop detected]
$r10   : 0x733a706f2c333132 ("213,op:s"?)
$r11   : 0x246             
$r12   : 0x4a              
$r13   : 0x1               
$r14   : 0x00007ffff5ee5620  →  0x00000000fbad2a84  →  0x0000000000000000
$r15   : 0x00007fffffffdb20  →  0x0000000041b58ab3
$eflags: [carry PARITY adjust ZERO sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000 
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fffffffd338│+0x0000: 0x00007ffff5b98bff  →   test rax, rax     ← $rsp
0x00007fffffffd340│+0x0008: 0x00007ffff5ee5620  →  0x00000000fbad2a84  →  0x0000000000000000
0x00007fffffffd348│+0x0010: 0x000000000000004a ("J"?)
0x00007fffffffd350│+0x0018: 0x0000619000001480  →  "STRUCTURE OF TIFF FILE (II): id:000000,src:000553+[...]"
0x00007fffffffd358│+0x0020: 0x00007fffffffd530  →  0x0000000041b58ab3
0x00007fffffffd360│+0x0028: 0x00007fffffffd960  →  0x0000000041b58ab3
0x00007fffffffd368│+0x0030: 0x00007ffff5b9a409  →   mov r13, rax
0x00007fffffffd370│+0x0038: 0x00007fffffffdb20  →  0x0000000041b58ab3
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
   0x7ffff5c172b2         mov    DWORD PTR [rbp*1+0x10750000], esp
   0x7ffff5c172b9  mov    eax, 0x1
   0x7ffff5c172be  syscall 
 → 0x7ffff5c172c0  cmp    rax, 0xfffffffffffff001
   0x7ffff5c172c6  jae    0x7ffff5c172f9 
   0x7ffff5c172c8  ret    
   0x7ffff5c172c9        sub    rsp, 0x8
   0x7ffff5c172cd        call   0x7ffff5c350d0 
   0x7ffff5c172d2        mov    QWORD PTR [rsp], rax
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "exiv2", stopped, reason: SIGINT
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7ffff5c172c0 → __write_nocancel()
[#1] 0x7ffff5b98bff → _IO_new_file_write(f=0x7ffff5ee5620 , data=0x619000001480, n=0x4a)
[#2] 0x7ffff5b9a409 → new_do_write(to_do=0x4a, data=0x619000001480 "STRUCTURE OF TIFF FILE (II): id:000000,src:000553+000213,op:splice,rep:64\n", '\276' , fp=0x7ffff5ee5620 )
[#3] 0x7ffff5b9a409 → _IO_new_do_write(fp=0x7ffff5ee5620 , data=0x619000001480 "STRUCTURE OF TIFF FILE (II): id:000000,src:000553+000213,op:splice,rep:64\n", '\276' , to_do=0x4a)
[#4] 0x7ffff5b9a81b → _IO_new_file_overflow(f=0x7ffff5ee5620 , ch=0xa)
[#5] 0x7ffff5b96533 → __GI__IO_putc(c=, fp=0x7ffff5ee5620 )
[#6] 0x7ffff6214a4a → std::ostream::put(char)()
[#7] 0x7ffff6214c3f → std::basic_ostream& std::endl(std::basic_ostream&)()
[#8] 0x7ffff673df1e → Exiv2::Image::printIFDStructure(this=0x61200000bec0, io=@0x60300000ecb0, out=@0x672ac0, option=Exiv2::kpsRecursive, start=0xff, bSwap=0x0, c=0x49, depth=0x0)
[#9] 0x7ffff673fe2a → Exiv2::Image::printTiffStructure(this=0x61200000bec0, io=@0x60300000ecb0, out=@0x672ac0, option=Exiv2::kpsRecursive, depth=0xffffffff, offset=0x0)