Regression test for GHSA-g9xm-7538-mq8w

kevinbackhouse · Feb 12, 2024 · 9d45a1d · 9d45a1d
1 parent 36e3d55
commit 9d45a1d
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 0 deletions.
diff --git a/test/data/issue_ghsa_g9xm_7538_mq8w_poc.mov b/test/data/issue_ghsa_g9xm_7538_mq8w_poc.mov
diff --git a/tests/bugfixes/github/test_issue_ghsa_g9xm_7538_mq8w.py b/tests/bugfixes/github/test_issue_ghsa_g9xm_7538_mq8w.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+
+class QuickTimeVideoNikonTagsDecoderOutOfBoundsRead(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8w
+    """
+    url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8w"
+
+    filename = path("$data_path/issue_ghsa_g9xm_7538_mq8w_poc.mov")
+    commands = ["$exiv2 $filename"]
+    retval = [1]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors
+    compare_stderr = check_no_ASAN_UBSAN_errors
diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py
@@ -117,6 +117,7 @@ def get_valid_files(data_dir):
         "issue_ghsa_7569_phvm_vwc2_poc.jp2",
         "issue_ghsa_mxw9_qx4c_6m8v_poc.jp2",
         "issue_ghsa_hrw9_ggg3_3r4r_poc.jpg",
+        "issue_ghsa_g9xm_7538_mq8w_poc.mov",
         "pocIssue283.jpg",
         "poc_1522.jp2",
         "xmpsdk.xmp",