Fetch libexif 0.6.21 to include the security fixes.

libexif/sources/libexif/exif-entry.c

 /* exif-entry.c
  *
  * Copyright (c) 2001 Lutz Mueller <lutz@users.sourceforge.net>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 1333 matching lines @@
                         snprintf (val, maxlen, _("Unknown value %i"), v_short);
                 else
                         strncpy (val, _(list[i].strings[j]), maxlen);
                 break;
 
         case EXIF_TAG_XP_TITLE:
         case EXIF_TAG_XP_COMMENT:
         case EXIF_TAG_XP_AUTHOR:
         case EXIF_TAG_XP_KEYWORDS:
         case EXIF_TAG_XP_SUBJECT:
-                /* Warning! The texts are converted from UTF16 to UTF8 */
-                /* FIXME: use iconv to convert into the locale encoding */
-                exif_convert_utf16_to_utf8(val, (unsigned short*)e->data, MIN(maxlen, e->size));
-                break;
+        {
+                /* Sanity check the size to prevent overflow */
+                if (e->size+sizeof(unsigned short) < e->size) break;
+                
+                /* The tag may not be U+0000-terminated , so make a local
+                U+0000-terminated copy before converting it */
+                unsigned short *utf16 = exif_mem_alloc (e->priv->mem, e->size+sizeof(unsigned short));
+                if (!utf16) break;
+                memcpy(utf16, e->data, e->size);
+                utf16[e->size/sizeof(unsigned short)] = 0;
+
+                /* Warning! The texts are converted from UTF16 to UTF8 */
+                /* FIXME: use iconv to convert into the locale encoding */
+                exif_convert_utf16_to_utf8(val, utf16, maxlen);
+                exif_mem_free(e->priv->mem, utf16);
+                break;
+       }
 
         default:
                 /* Use a generic value formatting */
                 exif_entry_format_value(e, val, maxlen);
         }
 
         return val;
 }
 
 
@@ skipping 335 matching lines @@
         case EXIF_TAG_MAKER_NOTE:
         case EXIF_TAG_USER_COMMENT:
         default:
                 e->components = 0;
                 e->format = EXIF_FORMAT_UNDEFINED;
                 e->size = 0;
                 e->data = NULL;
                 break;
         }
 }