From 16c32c6dfbca03a46d1a2bb87b6c1c365e6179d5 Mon Sep 17 00:00:00 2001
From: Friedemann Kleint <Friedemann.Kleint@digia.com>
Date: Sat, 27 Dec 2014 20:36:37 +0100
Subject: [PATCH] JPEG: Fix reading of EXIF orientation.

The orientation is unsigned short, read it as such. In
JPEG-files created by Ricoh/Pentax cameras, the data is saved in
Motorola format. Reading the wrong data size will produce invalid
values when converting the byte order.

Change-Id: I8f7c5dc5bfc10c02e090d3654aaefa047229a962
Task-number: QTBUG-43563
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@theqtcompany.com>
---
 src/gui/image/qjpeghandler.cpp                |   6 ++--
 ...jpeg_exif_orientation_value_6_motorola.jpg | Bin 0 -> 911 bytes
 tests/auto/gui/image/qimage/tst_qimage.cpp    |  33 +++++++++++++-----
 3 files changed, 27 insertions(+), 12 deletions(-)
 create mode 100644 tests/auto/gui/image/qimage/images/jpeg_exif_orientation_value_6_motorola.jpg

diff --git a/src/gui/image/qjpeghandler.cpp b/src/gui/image/qjpeghandler.cpp
index 87992bcced..9cf9947b6c 100644
--- a/src/gui/image/qjpeghandler.cpp
+++ b/src/gui/image/qjpeghandler.cpp
@@ -826,10 +826,10 @@ static int getExifOrientation(QByteArray &exifData)
             quint16 tag;
             quint16 type;
             quint32 components;
-            quint32 value;
-
-            stream >> tag >> type >> components >> value;
+            quint16 value;
+            quint16 dummy;
 
+            stream >> tag >> type >> components >> value >> dummy;
             if (tag == 0x0112) { // Tag Exif.Image.Orientation
                 if (components !=1)
                     return -1;
diff --git a/tests/auto/gui/image/qimage/images/jpeg_exif_orientation_value_6_motorola.jpg b/tests/auto/gui/image/qimage/images/jpeg_exif_orientation_value_6_motorola.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..0aa164b78b986bec1177bbac2ac5a181c5423a3e
GIT binary patch
literal 911
zcmex=<NpH&0WUXCHwH#VMg|aM`2UbW$+aRgje)_}mqCkxfq?@kC&a)EWHB<Z0ZAbE
zf1AM>q=O;=GK3-nK$`y_Vi4qD;9}rnW)x&#5@ci+Wc+`GK@992h+82fI|nCFT%3`C
z8R$hMz{JAJ_Wu?G4^Ws%fLQ?O$IH*y_QiBR%e|uc$R4OgLI9`*RSz>86AMre2Pni?
znU20z*E}(O|0)xpVmU#O`HZXx^^8m`%<Qae0*Z!$U@bti>={Et7y}qq*^7o>V5kX|
zXJEd-eBtBCP2TJ(MLY&)Z312I{k^GDc(Skfw94kMuRqPpTz)iINByvh&&J~_F`v$c
z3OY5|)B|mk0@(%x2=6d4voNv>Kx|?H*|cug`c<>nt?JI*)*hZZb?21O(2xytT}>`L
zGTYa_<?Om*j~mw{B_|5z{XCkuz5isk&x~Wm3ds_OE*l$9bxBK$UgF}qdr9<e5cqx`
zXrrtE0~64LNMXp#!o<qP$RHpn3=I)Bd#24N_x4@Towf28mvqcM@znGPsiVa|imooQ
z2ndK;a6WRw)@v&{ug`RSdHr-F+oZp<IZr=xUDgv8nQrKGm`7%^;kn{aEvFer)l;0N
zY@V{r$uD-!bG=is@2l^}16?2{fZ}1G*MXM9BEw!W)1o#scS8fuqm64H>$}=|x&fuY
zaSKkr0!;ltBg6$!0}W_|Ak+*{><BRL)sSImc*NkqRA4{F?{{y@$zV`ui-EKuf*Q$Y
zP)G~p9}#|WSUI$7QhUP=hC+3w7@!sr0aOhP3<_|k3W&y>ywSyfxM$C)6-T#zP`FzE
G|0V$P?A^-%

literal 0
HcmV?d00001

diff --git a/tests/auto/gui/image/qimage/tst_qimage.cpp b/tests/auto/gui/image/qimage/tst_qimage.cpp
index fcee2884d9..1fef747399 100644
--- a/tests/auto/gui/image/qimage/tst_qimage.cpp
+++ b/tests/auto/gui/image/qimage/tst_qimage.cpp
@@ -173,6 +173,7 @@ private slots:
     void invertPixelsRGB_data();
     void invertPixelsRGB();
 
+    void exifOrientation_data();
     void exifOrientation();
 
     void cleanupFunctions();
@@ -2626,20 +2627,34 @@ void tst_QImage::invertPixelsRGB()
     QCOMPARE(qBlue(pixel) >> 4, (255 - 96) >> 4);
 }
 
+void tst_QImage::exifOrientation_data()
+{
+    QTest::addColumn<QString>("fileName");
+    QTest::newRow("Orientation 1, Intel format") << m_prefix + "jpeg_exif_orientation_value_1.jpg";
+    QTest::newRow("Orientation 2, Intel format") << m_prefix + "jpeg_exif_orientation_value_2.jpg";
+    QTest::newRow("Orientation 3, Intel format") << m_prefix + "jpeg_exif_orientation_value_3.jpg";
+    QTest::newRow("Orientation 4, Intel format") << m_prefix + "jpeg_exif_orientation_value_4.jpg";
+    QTest::newRow("Orientation 5, Intel format") << m_prefix + "jpeg_exif_orientation_value_5.jpg";
+    QTest::newRow("Orientation 6, Intel format") << m_prefix + "jpeg_exif_orientation_value_6.jpg";
+    QTest::newRow("Orientation 6, Motorola format") << m_prefix + "jpeg_exif_orientation_value_6_motorola.jpg";
+    QTest::newRow("Orientation 7, Intel format") << m_prefix + "jpeg_exif_orientation_value_7.jpg";
+    QTest::newRow("Orientation 8, Intel format") << m_prefix + "jpeg_exif_orientation_value_8.jpg";
+}
+
 void tst_QImage::exifOrientation()
 {
-    for (unsigned int i = 1; i <= 8; ++i) {
-        QImage img;
-        QRgb px;
+    QFETCH(QString, fileName);
 
-        QVERIFY(img.load(m_prefix + QString::fromLatin1("jpeg_exif_orientation_value_%1.jpg").arg(i)));
+    QImage img;
+    QRgb px;
 
-        px = img.pixel(0, 0);
-        QVERIFY(qRed(px) > 250 && qGreen(px) < 5 && qBlue(px) < 5);
+    QVERIFY(img.load(fileName));
 
-        px = img.pixel(img.width() - 1, 0);
-        QVERIFY(qRed(px) < 5 && qGreen(px) < 5 && qBlue(px) > 250);
-    }
+    px = img.pixel(0, 0);
+    QVERIFY(qRed(px) > 250 && qGreen(px) < 5 && qBlue(px) < 5);
+
+    px = img.pixel(img.width() - 1, 0);
+    QVERIFY(qRed(px) < 5 && qGreen(px) < 5 && qBlue(px) > 250);
 }
 
 static void cleanupFunction(void* info)