exiv2: fix security issues

[mweinelt]

Motivation for this change

Fixes two out of bounds reads, one input validation issue and one heap
buffer overflow.

Fixes: CVE-2021-3482, CVE-2021-29458, CVE-2021-29457, CVE-2021-29470

https://nvd.nist.gov/vuln/detail/CVE-2021-29458
https://nvd.nist.gov/vuln/detail/CVE-2021-29470
https://nvd.nist.gov/vuln/detail/CVE-2021-3482
https://nvd.nist.gov/vuln/detail/CVE-2021-29457

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[mweinelt]

Tests are failing, so something is wrong. I rebased the last patch on top of v0.27.3 and I'm pretty confident I didn't screw that up.

An alternative could be updating to 0.27.4-rc2 + Exiv2/exiv2#1581.

---- Running python_tests ----

bash -c  . functions.source ; cd ../tests ; if [ ! -z y ]; then verbose=--verbose ;fi ; python3 runner.py
....................................s...........FF....s............ss............s................F....................s...................................................s..........
======================================================================
FAIL: test_run (bugfixes.github.test_issue_1522.issue_1522_exif_asan)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/build/source/tests/system_tests.py", line 653, in test_run
    self.compare_stderr(i, command, processed_stderr, stderr)
  File "/build/source/tests/system_tests.py", line 774, in compare_stderr
    self._compare_output(
  File "/build/source/tests/system_tests.py", line 746, in _compare_output
    self.assertMultiLineEqual(
AssertionError: '/build/source/test/data/poc_1522.jp2: Fai[18 chars]le\n' != 'Warning: Failed to decode Exif metadata.\[67 chars]le\n'
+ Warning: Failed to decode Exif metadata.
- /build/source/test/data/poc_1522.jp2: Failed to open the file
?                                       ^  ----------
+ /build/source/test/data/poc_1522.jp2: No Exif data found in the file
?                                       ^^^^^^^^^ +++++++++
 : Standard error does not match

======================================================================
FAIL: test_run (bugfixes.github.test_issue_1530.CrwEncode0x1810IntegerOverflow)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/build/source/tests/system_tests.py", line 653, in test_run
    self.compare_stderr(i, command, processed_stderr, stderr)
  File "/build/source/tests/system_tests.py", line 774, in compare_stderr
    self._compare_output(
  File "/build/source/tests/system_tests.py", line 746, in _compare_output
    self.assertMultiLineEqual(
AssertionError: '/bui[35 chars]crw: Failed to open the file\n/build/source/te[49 chars]le\n' != '/bui[35 chars]crw: Could not write metadata to file: corrupt[15 chars]ta\n'
+ /build/source/test/data/issue_1530_poc.crw: Could not write metadata to file: corrupted image metadata
- /build/source/test/data/issue_1530_poc.crw: Failed to open the file
- /build/source/test/data/issue_1530_poc.exv: Failed to open the file
 : Standard error does not match

======================================================================
FAIL: test_run (bugfixes.github.test_issue_ghsa_8949_hhfh_j7rj.Jp2ImageEncodeJp2HeaderOutOfBoundsRead)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/build/source/tests/system_tests.py", line 653, in test_run
    self.compare_stderr(i, command, processed_stderr, stderr)
  File "/build/source/tests/system_tests.py", line 774, in compare_stderr
    self._compare_output(
  File "/build/source/tests/system_tests.py", line 746, in _compare_output
    self.assertMultiLineEqual(
AssertionError: '/build/source/test/data/issue_ghsa_8949_h[39 chars]le\n' != 'Error: XMP Toolkit error 201: XML parsing[166 chars]ta\n'
- /build/source/test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2: Failed to open the file
+ Error: XMP Toolkit error 201: XML parsing failure
+ Warning: Failed to decode XMP metadata.
+ /build/source/test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2: Could not write metadata to file: corrupted image metadata
 : Standard error does not match

----------------------------------------------------------------------
Ran 182 tests in 4.200s

FAILED (failures=3, skipped=7)

[ajs124]

This probably shouldn't be here, should it?

[ajs124]

0.27.4 was scheduled to be released 2 weeks ago, not sure what happened to that. RC3 compiles and passes their test suite, for me.

Edit: "Exiv2 v0.27.4 GM is likely to ship on 2021-06-15.
The scheduled GM date was 2021-05-22. The schedule slipped because Security Researchers submitted CVEs during the RC2 review period." apparently happened: https://github.com/Exiv2/exiv2/releases/tag/v0.27.4-RC3

[ckauhaus]

https://github.com/Exiv2/exiv2/releases/tag/v0.27.4 is out now.

[mweinelt]

I don't have the capacity to handle this at the moment and would be happy if someone could take this pull request over.

[sikmir]

Fixed in #127172.

[ckauhaus]

I think we can safely close this one.