Blame SOURCES/exiv2-CVE-2018-8976.patch

3f58c5
diff --git a/src/jpgimage.cpp b/src/jpgimage.cpp
3f58c5
index 9afcb58..ca83f14 100644
3f58c5
--- a/src/jpgimage.cpp
3f58c5
+++ b/src/jpgimage.cpp
3f58c5
@@ -34,6 +34,7 @@ EXIV2_RCSID("@(#) $Id$")
3f58c5
 #include "image_int.hpp"
3f58c5
 #include "error.hpp"
3f58c5
 #include "futils.hpp"
3f58c5
+#include "enforce.hpp"
3f58c5
 
3f58c5
 #ifdef WIN32
3f58c5
 #include <windows.h>
3f58c5
@@ -328,12 +329,14 @@ namespace Exiv2 {
3f58c5
         int c = -1;
3f58c5
         // Skips potential padding between markers
3f58c5
         while ((c=io_->getb()) != 0xff) {
3f58c5
-            if (c == EOF) return -1;
3f58c5
+            if (c == EOF)
3f58c5
+                return -1;
3f58c5
         }
3f58c5
 
3f58c5
         // Markers can start with any number of 0xff
3f58c5
         while ((c=io_->getb()) == 0xff) {
3f58c5
-            if (c == EOF) return -2;
3f58c5
+            if (c == EOF)
3f58c5
+                return -2;
3f58c5
         }
3f58c5
         return c;
3f58c5
     }
3f58c5
@@ -564,85 +567,88 @@ namespace Exiv2 {
3f58c5
      out << Internal::stringFormat("%8ld | 0xff%02x %-5s", \
3f58c5
                              io_->tell()-2,marker,nm[marker].c_str())
3f58c5
 
3f58c5
-    void JpegBase::printStructure(std::ostream& out, PrintStructureOption option,int depth)
3f58c5
+    void JpegBase::printStructure(std::ostream& out, PrintStructureOption option, int depth)
3f58c5
     {
3f58c5
-        if (io_->open() != 0) throw Error(9, io_->path(), strError());
3f58c5
+        if (io_->open() != 0)
3f58c5
+            throw Error(9, io_->path(), strError());
3f58c5
         // Ensure that this is the correct image type
3f58c5
         if (!isThisType(*io_, false)) {
3f58c5
-            if (io_->error() || io_->eof()) throw Error(14);
3f58c5
+            if (io_->error() || io_->eof())
3f58c5
+                throw Error(14);
3f58c5
             throw Error(15);
3f58c5
         }
3f58c5
 
3f58c5
-        bool bPrint = option==kpsBasic || option==kpsRecursive;
3f58c5
+        bool bPrint = option == kpsBasic || option == kpsRecursive;
3f58c5
         Exiv2::Uint32Vector iptcDataSegs;
3f58c5
 
3f58c5
-        if ( bPrint || option == kpsXMP || option == kpsIccProfile || option == kpsIptcErase ) {
3f58c5
+        if (bPrint || option == kpsXMP || option == kpsIccProfile || option == kpsIptcErase) {
3f58c5
 
3f58c5
             // nmonic for markers
3f58c5
-            std::string nm[256] ;
3f58c5
-            nm[0xd8]="SOI"  ;
3f58c5
-            nm[0xd9]="EOI"  ;
3f58c5
-            nm[0xda]="SOS"  ;
3f58c5
-            nm[0xdb]="DQT"  ;
3f58c5
-            nm[0xdd]="DRI"  ;
3f58c5
-            nm[0xfe]="COM"  ;
3f58c5
+            std::string nm[256];
3f58c5
+            nm[0xd8] = "SOI";
3f58c5
+            nm[0xd9] = "EOI";
3f58c5
+            nm[0xda] = "SOS";
3f58c5
+            nm[0xdb] = "DQT";
3f58c5
+            nm[0xdd] = "DRI";
3f58c5
+            nm[0xfe] = "COM";
3f58c5
 
3f58c5
             // 0xe0 .. 0xef are APPn
3f58c5
             // 0xc0 .. 0xcf are SOFn (except 4)
3f58c5
-            nm[0xc4]="DHT"  ;
3f58c5
-            for ( int i = 0 ; i <= 15 ; i++ ) {
3f58c5
+            nm[0xc4] = "DHT";
3f58c5
+            for (int i = 0; i <= 15; i++) {
3f58c5
                 char MN[10];
3f58c5
-                sprintf(MN,"APP%d",i);
3f58c5
-                nm[0xe0+i] = MN;
3f58c5
-                if ( i != 4 ) {
3f58c5
-                    sprintf(MN,"SOF%d",i);
3f58c5
-                    nm[0xc0+i] = MN;
3f58c5
+                sprintf(MN, "APP%d", i);
3f58c5
+                nm[0xe0 + i] = MN;
3f58c5
+                if (i != 4) {
3f58c5
+                    sprintf(MN, "SOF%d", i);
3f58c5
+                    nm[0xc0 + i] = MN;
3f58c5
                 }
3f58c5
             }
3f58c5
 
3f58c5
             // which markers have a length field?
3f58c5
             bool mHasLength[256];
3f58c5
-            for ( int i = 0 ; i < 256 ; i ++ )
3f58c5
-                mHasLength[i]
3f58c5
-                  =   ( i >= sof0_ && i <= sof15_)
3f58c5
-                  ||  ( i >= app0_ && i <= (app0_ | 0x0F))
3f58c5
-                  ||  ( i == dht_  || i == dqt_ || i == dri_ || i == com_ || i == sos_ )
3f58c5
-                  ;
3f58c5
+            for (int i = 0; i < 256; i++)
3f58c5
+                mHasLength[i] = (i >= sof0_ && i <= sof15_) || (i >= app0_ && i <= (app0_ | 0x0F)) ||
3f58c5
+                                (i == dht_ || i == dqt_ || i == dri_ || i == com_ || i == sos_);
3f58c5
 
3f58c5
             // Container for the signature
3f58c5
-            bool        bExtXMP    = false;
3f58c5
-            long        bufRead    =  0;
3f58c5
-            const long  bufMinSize = 36;
3f58c5
-            DataBuf     buf(bufMinSize);
3f58c5
+            bool bExtXMP = false;
3f58c5
+            long bufRead = 0;
3f58c5
+            const long bufMinSize = 36;
3f58c5
+            DataBuf buf(bufMinSize);
3f58c5
 
3f58c5
             // Read section marker
3f58c5
             int marker = advanceToMarker();
3f58c5
-            if (marker < 0) throw Error(15);
3f58c5
+            if (marker < 0)
3f58c5
+                throw Error(15);
3f58c5
 
3f58c5
-            bool    done = false;
3f58c5
-            bool    first= true;
3f58c5
+            bool done = false;
3f58c5
+            bool first = true;
3f58c5
             while (!done) {
3f58c5
                 // print marker bytes
3f58c5
-                if ( first && bPrint ) {
3f58c5
+                if (first && bPrint) {
3f58c5
                     out << "STRUCTURE OF JPEG FILE: " << io_->path() << std::endl;
3f58c5
-                    out << " address | marker       |  length | data" << std::endl ;
3f58c5
+                    out << " address | marker       |  length | data" << std::endl;
3f58c5
                     REPORT_MARKER;
3f58c5
                 }
3f58c5
-                first    = false;
3f58c5
+                first = false;
3f58c5
                 bool bLF = bPrint;
3f58c5
 
3f58c5
                 // Read size and signature
3f58c5
                 std::memset(buf.pData_, 0x0, buf.size_);
3f58c5
                 bufRead = io_->read(buf.pData_, bufMinSize);
3f58c5
-                if (io_->error()) throw Error(14);
3f58c5
-                if (bufRead < 2) throw Error(15);
3f58c5
-                uint16_t size = mHasLength[marker] ? getUShort(buf.pData_, bigEndian) : 0 ;
3f58c5
-                if ( bPrint &&  mHasLength[marker] ) out << Internal::stringFormat(" | %7d ", size);
3f58c5
+                if (io_->error())
3f58c5
+                    throw Error(14);
3f58c5
+                if (bufRead < 2)
3f58c5
+                    throw Error(15);
3f58c5
+                uint16_t size = mHasLength[marker] ? getUShort(buf.pData_, bigEndian) : 0;
3f58c5
+                if (bPrint && mHasLength[marker])
3f58c5
+                    out << Internal::stringFormat(" | %7d ", size);
3f58c5
 
3f58c5
                 // print signature for APPn
3f58c5
                 if (marker >= app0_ && marker <= (app0_ | 0x0F)) {
3f58c5
                     // http://www.adobe.com/content/dam/Adobe/en/devnet/xmp/pdfs/XMPSpecificationPart3.pdf p75
3f58c5
-                    const char* signature = (const char*) buf.pData_+2;
3f58c5
+                    const char* signature = (const char*)buf.pData_ + 2;
3f58c5
 
3f58c5
                     // 728 rmills@rmillsmbp:~/gnu/exiv2/ttt $ exiv2 -pS test/data/exiv2-bug922.jpg
3f58c5
                     // STRUCTURE OF JPEG FILE: test/data/exiv2-bug922.jpg
3f58c5
@@ -651,13 +657,13 @@ namespace Exiv2 {
3f58c5
                     //       2 | 0xe1 APP1  |     911 | Exif..MM.*.......%.........#....
3f58c5
                     //     915 | 0xe1 APP1  |     870 | http://ns.adobe.com/xap/1.0/.
3f58c5
                     //    1787 | 0xe1 APP1  |   65460 | http://ns.adobe.com/xmp/extensio
3f58c5
-                    if ( option == kpsXMP && std::string(signature).find("http://ns.adobe.com/x")== 0 ) {
3f58c5
+                    if (option == kpsXMP && std::string(signature).find("http://ns.adobe.com/x") == 0) {
3f58c5
                         // extract XMP
3f58c5
-                        if ( size > 0 ) {
3f58c5
-                            io_->seek(-bufRead , BasicIo::cur);
3f58c5
-                            byte* xmp  = new byte[size+1];
3f58c5
-                            io_->read(xmp,size);
3f58c5
-                            int start = 0 ;
3f58c5
+                        if (size > 0) {
3f58c5
+                            io_->seek(-bufRead, BasicIo::cur);
3f58c5
+                            byte* xmp = new byte[size + 1];
3f58c5
+                            io_->read(xmp, size);
3f58c5
+                            int start = 0;
3f58c5
 
3f58c5
                             // http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/xmp/pdfs/XMPSpecificationPart3.pdf
3f58c5
                             // if we find HasExtendedXMP, set the flag and ignore this block
3f58c5
@@ -666,79 +672,80 @@ namespace Exiv2 {
3f58c5
                             // we could implement out of sequence with a dictionary of sequence/offset
3f58c5
                             // and dumping the XMP in a post read operation similar to kpsIptcErase
3f58c5
                             // for the moment, dumping 'on the fly' is working fine
3f58c5
-                            if ( ! bExtXMP ) {
3f58c5
-                                while (xmp[start]) start++;
3f58c5
+                            if (!bExtXMP) {
3f58c5
+                                while (xmp[start])
3f58c5
+                                    start++;
3f58c5
                                 start++;
3f58c5
-                                if ( ::strstr((char*)xmp+start,"HasExtendedXMP") ) {
3f58c5
-                                    start  = size ; // ignore this packet, we'll get on the next time around
3f58c5
+                                if (::strstr((char*)xmp + start, "HasExtendedXMP")) {
3f58c5
+                                    start = size;  // ignore this packet, we'll get on the next time around
3f58c5
                                     bExtXMP = true;
3f58c5
                                 }
3f58c5
                             } else {
3f58c5
-                                start = 2+35+32+4+4; // Adobe Spec, p19
3f58c5
+                                start = 2 + 35 + 32 + 4 + 4;  // Adobe Spec, p19
3f58c5
                             }
3f58c5
 
3f58c5
-                            out.write((const char*)(xmp+start),size-start);
3f58c5
-                            delete [] xmp;
3f58c5
+                            out.write((const char*)(xmp + start), size - start);
3f58c5
+                            delete[] xmp;
3f58c5
                             bufRead = size;
3f58c5
                             done = !bExtXMP;
3f58c5
                         }
3f58c5
-                    } else if ( option == kpsIccProfile && std::strcmp(signature,iccId_) == 0 ) {
3f58c5
+                    } else if (option == kpsIccProfile && std::strcmp(signature, iccId_) == 0) {
3f58c5
                         // extract ICCProfile
3f58c5
-                        if ( size > 0 ) {
3f58c5
-                            io_->seek(-bufRead, BasicIo::cur); // back to buffer (after marker)
3f58c5
-                            io_->seek(    14+2, BasicIo::cur); // step over header
3f58c5
-                            DataBuf   icc(size-(14+2));
3f58c5
-                            io_->read(             icc.pData_,icc.size_);
3f58c5
-                            out.write((const char*)icc.pData_,icc.size_);
3f58c5
+                        if (size > 0) {
3f58c5
+                            io_->seek(-bufRead, BasicIo::cur);  // back to buffer (after marker)
3f58c5
+                            io_->seek(14 + 2, BasicIo::cur);    // step over header
3f58c5
+                            DataBuf icc(size - (14 + 2));
3f58c5
+                            io_->read(icc.pData_, icc.size_);
3f58c5
+                            out.write((const char*)icc.pData_, icc.size_);
3f58c5
 #ifdef DEBUG
3f58c5
                             std::cout << "iccProfile size = " << icc.size_ << std::endl;
3f58c5
 #endif
3f58c5
                             bufRead = size;
3f58c5
                         }
3f58c5
-                    } else if ( option == kpsIptcErase && std::strcmp(signature,"Photoshop 3.0") == 0 ) {
3f58c5
+                    } else if (option == kpsIptcErase && std::strcmp(signature, "Photoshop 3.0") == 0) {
3f58c5
                         // delete IPTC data segment from JPEG
3f58c5
-                        if ( size > 0 ) {
3f58c5
-                            io_->seek(-bufRead , BasicIo::cur);
3f58c5
+                        if (size > 0) {
3f58c5
+                            io_->seek(-bufRead, BasicIo::cur);
3f58c5
                             iptcDataSegs.push_back(io_->tell());
3f58c5
                             iptcDataSegs.push_back(size);
3f58c5
                         }
3f58c5
-                    } else if ( bPrint ) {
3f58c5
-                        out << "| " << Internal::binaryToString(buf,size>32?32:size,size>0?2:0);
3f58c5
-                        if ( std::strcmp(signature,iccId_) == 0 ) {
3f58c5
-                            int chunk  = (int) signature[12];
3f58c5
-                            int chunks = (int) signature[13];
3f58c5
-                            out << Internal::stringFormat(" chunk %d/%d",chunk,chunks);
3f58c5
+                    } else if (bPrint) {
3f58c5
+                        out << "| " << Internal::binaryToString(buf, size > 32 ? 32 : size, size > 0 ? 2 : 0);
3f58c5
+                        if (std::strcmp(signature, iccId_) == 0) {
3f58c5
+                            int chunk = (int)signature[12];
3f58c5
+                            int chunks = (int)signature[13];
3f58c5
+                            out << Internal::stringFormat(" chunk %d/%d", chunk, chunks);
3f58c5
                         }
3f58c5
                     }
3f58c5
 
3f58c5
                     // for MPF: http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/MPF.html
3f58c5
                     // for FLIR: http://owl.phy.queensu.ca/~phil/exiftool/TagNames/FLIR.html
3f58c5
-                    bool bFlir = option == kpsRecursive && marker == (app0_+1) && std::strcmp(signature,"FLIR")==0;
3f58c5
-                    bool bExif = option == kpsRecursive && marker == (app0_+1) && std::strcmp(signature,"Exif")==0;
3f58c5
-                    bool bMPF  = option == kpsRecursive && marker == (app0_+2) && std::strcmp(signature,"MPF")==0;
3f58c5
-                    bool bPS   = option == kpsRecursive                        && std::strcmp(signature,"Photoshop 3.0")==0;
3f58c5
-                    if( bFlir || bExif || bMPF || bPS ) {
3f58c5
+                    bool bFlir = option == kpsRecursive && marker == (app0_ + 1) && std::strcmp(signature, "FLIR") == 0;
3f58c5
+                    bool bExif = option == kpsRecursive && marker == (app0_ + 1) && std::strcmp(signature, "Exif") == 0;
3f58c5
+                    bool bMPF = option == kpsRecursive && marker == (app0_ + 2) && std::strcmp(signature, "MPF") == 0;
3f58c5
+                    bool bPS = option == kpsRecursive && std::strcmp(signature, "Photoshop 3.0") == 0;
3f58c5
+                    if (bFlir || bExif || bMPF || bPS) {
3f58c5
                         // extract Exif data block which is tiff formatted
3f58c5
-                        if ( size > 0 ) {
3f58c5
+                        if (size > 0) {
3f58c5
                             out << std::endl;
3f58c5
 
3f58c5
                             // allocate storage and current file position
3f58c5
-                            byte*    exif      = new byte[size];
3f58c5
-                            uint32_t restore   = io_->tell();
3f58c5
+                            byte* exif = new byte[size];
3f58c5
+                            uint32_t restore = io_->tell();
3f58c5
 
3f58c5
                             // copy the data to memory
3f58c5
-                            io_->seek(-bufRead , BasicIo::cur);
3f58c5
-                            io_->read(exif,size);
3f58c5
-                            uint32_t start     = std::strcmp(signature,"Exif")==0 ? 8 : 6;
3f58c5
-                            uint32_t max       = (uint32_t) size -1;
3f58c5
+                            io_->seek(-bufRead, BasicIo::cur);
3f58c5
+                            io_->read(exif, size);
3f58c5
+                            uint32_t start = std::strcmp(signature, "Exif") == 0 ? 8 : 6;
3f58c5
+                            uint32_t max = (uint32_t)size - 1;
3f58c5
 
3f58c5
                             // is this an fff block?
3f58c5
-                            if ( bFlir ) {
3f58c5
-                                start = 0 ;
3f58c5
+                            if (bFlir) {
3f58c5
+                                start = 0;
3f58c5
                                 bFlir = false;
3f58c5
-                                while ( start < max ) {
3f58c5
-                                    if ( std::strcmp((const char*)(exif+start),"FFF")==0 ) {
3f58c5
-                                        bFlir = true ;
3f58c5
+                                while (start < max) {
3f58c5
+                                    if (std::strcmp((const char*)(exif + start), "FFF") == 0) {
3f58c5
+                                        bFlir = true;
3f58c5
                                         break;
3f58c5
                                     }
3f58c5
                                     start++;
3f58c5
@@ -747,78 +754,90 @@ namespace Exiv2 {
3f58c5
 
3f58c5
                             // there is a header in FLIR, followed by a tiff block
3f58c5
                             // Hunt down the tiff using brute force
3f58c5
-                            if ( bFlir ) {
3f58c5
+                            if (bFlir) {
3f58c5
                                 // FLIRFILEHEAD* pFFF = (FLIRFILEHEAD*) (exif+start) ;
3f58c5
-                                while ( start < max ) {
3f58c5
-                                    if ( exif[start] == 'I' && exif[start+1] == 'I' ) break;
3f58c5
-                                    if ( exif[start] == 'M' && exif[start+1] == 'M' ) break;
3f58c5
+                                while (start < max) {
3f58c5
+                                    if (exif[start] == 'I' && exif[start + 1] == 'I')
3f58c5
+                                        break;
3f58c5
+                                    if (exif[start] == 'M' && exif[start + 1] == 'M')
3f58c5
+                                        break;
3f58c5
                                     start++;
3f58c5
                                 }
3f58c5
-                                if ( start < max ) std::cout << "  FFF start = " << start << std::endl ;
3f58c5
+                                if ( start < max )
3f58c5
+                                    std::cout << "  FFF start = " << start << std::endl;
3f58c5
                                 // << " index = " << pFFF->dwIndexOff << std::endl;
3f58c5
                             }
3f58c5
 
3f58c5
-                            if ( bPS ) {
3f58c5
-                                IptcData::printStructure(out,exif,size,depth);
3f58c5
+                            if (bPS) {
3f58c5
+                                IptcData::printStructure(out, exif, size, depth);
3f58c5
                             } else {
3f58c5
                                 // create a copy on write memio object with the data, then print the structure
3f58c5
-                                BasicIo::AutoPtr p = BasicIo::AutoPtr(new MemIo(exif+start,size-start));
3f58c5
-                                if ( start < max ) printTiffStructure(*p,out,option,depth);
3f58c5
+                                BasicIo::AutoPtr p = BasicIo::AutoPtr(new MemIo(exif + start, size - start));
3f58c5
+                                if (start < max)
3f58c5
+                                    printTiffStructure(*p, out, option, depth);
3f58c5
                             }
3f58c5
 
3f58c5
                             // restore and clean up
3f58c5
-                            io_->seek(restore,Exiv2::BasicIo::beg);
3f58c5
-                            delete [] exif;
3f58c5
-                            bLF    = false;
3f58c5
+                            io_->seek(restore, Exiv2::BasicIo::beg);
3f58c5
+                            delete[] exif;
3f58c5
+                            bLF = false;
3f58c5
                         }
3f58c5
                     }
3f58c5
                 }
3f58c5
 
3f58c5
                 // print COM marker
3f58c5
-                if ( bPrint && marker == com_ ) {
3f58c5
-                    int n = (size-2)>32?32:size-2; // size includes 2 for the two bytes for size!
3f58c5
-                    out << "| " << Internal::binaryToString(buf,n,2); // start after the two bytes
3f58c5
+                if (bPrint && marker == com_) {
3f58c5
+                    int n = (size - 2) > 32 ? 32 : size - 2;             // size includes 2 for the two bytes for size!
3f58c5
+                    out << "| " << Internal::binaryToString(buf, n, 2);  // start after the two bytes
3f58c5
                 }
3f58c5
 
3f58c5
                 // Skip the segment if the size is known
3f58c5
-                if (io_->seek(size - bufRead, BasicIo::cur)) throw Error(14);
3f58c5
+                if (io_->seek(size - bufRead, BasicIo::cur))
3f58c5
+                    throw Error(14);
3f58c5
 
3f58c5
-                if ( bLF ) out << std::endl;
3f58c5
+                if (bLF)
3f58c5
+                    out << std::endl;
3f58c5
 
3f58c5
                 if (marker != sos_) {
3f58c5
                     // Read the beginning of the next segment
3f58c5
                     marker = advanceToMarker();
3f58c5
+                    enforce(marker>=0, kerNoImageInInputData);
3f58c5
                     REPORT_MARKER;
3f58c5
                 }
3f58c5
                 done |= marker == eoi_ || marker == sos_;
3f58c5
-                if ( done && bPrint ) out << std::endl;
3f58c5
+                if (done && bPrint)
3f58c5
+                    out << std::endl;
3f58c5
             }
3f58c5
         }
3f58c5
-        if ( option == kpsIptcErase && iptcDataSegs.size() ) {
3f58c5
+        if (option == kpsIptcErase && iptcDataSegs.size()) {
3f58c5
 #ifdef DEBUG
3f58c5
             std::cout << "iptc data blocks: " << iptcDataSegs.size() << std::endl;
3f58c5
-            uint32_t toggle = 0 ;
3f58c5
-            for ( Uint32Vector_i i = iptcDataSegs.begin(); i != iptcDataSegs.end() ; i++ ) {
3f58c5
-                std::cout << *i ;
3f58c5
-                if ( toggle++ % 2 ) std::cout << std::endl; else std::cout << ' ' ;
3f58c5
+            uint32_t toggle = 0;
3f58c5
+            for (Uint32Vector_i i = iptcDataSegs.begin(); i != iptcDataSegs.end(); i++) {
3f58c5
+                std::cout << *i;
3f58c5
+                if (toggle++ % 2)
3f58c5
+                    std::cout << std::endl;
3f58c5
+                else
3f58c5
+                    std::cout << ' ';
3f58c5
             }
3f58c5
 #endif
3f58c5
-            uint32_t count  = (uint32_t) iptcDataSegs.size();
3f58c5
+            uint32_t count = (uint32_t)iptcDataSegs.size();
3f58c5
 
3f58c5
             // figure out which blocks to copy
3f58c5
-            uint64_t* pos = new uint64_t[count+2];
3f58c5
-            pos[0]        = 0 ;
3f58c5
+            uint64_t* pos = new uint64_t[count + 2];
3f58c5
+            pos[0] = 0;
3f58c5
             // copy the data that is not iptc
3f58c5
             Uint32Vector_i it = iptcDataSegs.begin();
3f58c5
-            for ( uint64_t  i = 0 ; i < count ; i++ ) {
3f58c5
-                bool  bOdd  = (i%2)!=0;
3f58c5
-                bool  bEven = !bOdd;
3f58c5
-                pos[i+1]    = bEven ? *it : pos[i] + *it;
3f58c5
+            for (uint64_t i = 0; i < count; i++) {
3f58c5
+                bool bOdd = (i % 2) != 0;
3f58c5
+                bool bEven = !bOdd;
3f58c5
+                pos[i + 1] = bEven ? *it : pos[i] + *it;
3f58c5
                 it++;
3f58c5
             }
3f58c5
-            pos[count+1] = io_->size() - pos[count];
3f58c5
+            pos[count + 1] = io_->size() - pos[count];
3f58c5
 #ifdef DEBUG
3f58c5
-            for ( uint64_t i = 0 ; i < count+2 ; i++ ) std::cout << pos[i] << " " ;
3f58c5
+            for (uint64_t i = 0; i < count + 2; i++)
3f58c5
+                std::cout << pos[i] << " ";
3f58c5
             std::cout << std::endl;
3f58c5
 #endif
3f58c5
             // $ dd bs=1 skip=$((0)) count=$((13164)) if=ETH0138028.jpg of=E1.jpg
3f58c5
@@ -829,29 +848,30 @@ namespace Exiv2 {
3f58c5
             // binary copy io_ to a temporary file
3f58c5
             BasicIo::AutoPtr tempIo(new MemIo);
3f58c5
 
3f58c5
-            assert (tempIo.get() != 0);
3f58c5
-            for ( uint64_t i = 0 ; i < (count/2)+1 ; i++ ) {
3f58c5
-                uint64_t start  = pos[2*i]+2 ; // step JPG 2 byte marker
3f58c5
-                if ( start == 2 ) start = 0  ; // read the file 2 byte SOI
3f58c5
-                long length = (long) (pos[2*i+1] - start) ;
3f58c5
-                if ( length ) {
3f58c5
+            assert(tempIo.get() != 0);
3f58c5
+            for (uint64_t i = 0; i < (count / 2) + 1; i++) {
3f58c5
+                uint64_t start = pos[2 * i] + 2;  // step JPG 2 byte marker
3f58c5
+                if (start == 2)
3f58c5
+                    start = 0;  // read the file 2 byte SOI
3f58c5
+                long length = (long)(pos[2 * i + 1] - start);
3f58c5
+                if (length) {
3f58c5
 #ifdef DEBUG
3f58c5
-                    std::cout << start <<":"<< length << std::endl;
3f58c5
+                    std::cout << start << ":" << length << std::endl;
3f58c5
 #endif
3f58c5
-                    io_->seek(start,BasicIo::beg);
3f58c5
+                    io_->seek(start, BasicIo::beg);
3f58c5
                     DataBuf buf(length);
3f58c5
-                    io_->read(buf.pData_,buf.size_);
3f58c5
-                    tempIo->write(buf.pData_,buf.size_);
3f58c5
+                    io_->read(buf.pData_, buf.size_);
3f58c5
+                    tempIo->write(buf.pData_, buf.size_);
3f58c5
                 }
3f58c5
             }
3f58c5
-            delete [] pos;
3f58c5
+            delete[] pos;
3f58c5
 
3f58c5
             io_->seek(0, BasicIo::beg);
3f58c5
-            io_->transfer(*tempIo); // may throw
3f58c5
+            io_->transfer(*tempIo);  // may throw
3f58c5
             io_->seek(0, BasicIo::beg);
3f58c5
             readMetadata();
3f58c5
         }
3f58c5
-    } // JpegBase::printStructure
3f58c5
+    }  // JpegBase::printStructure
3f58c5
 
3f58c5
     void JpegBase::writeMetadata()
3f58c5
     {