CVE-2026-40386.patch

From 4e39be50fea6fe55cc9d4dd719a947b4c8193c13 Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meissner@suse.de>
Date: Thu, 2 Apr 2026 13:26:31 +0200
Subject: [PATCH] fixed 2 unsigned integer underflows

this could cause crashes or data leaks.

Reported-by: Kerwin <kerwinxia66001@gmail.com>
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b.patch
---
 libexif/fuji/exif-mnote-data-fuji.c       | 2 +-
 libexif/olympus/exif-mnote-data-olympus.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c
index e3af4e1..3f295d3 100644
--- a/libexif/fuji/exif-mnote-data-fuji.c
+++ b/libexif/fuji/exif-mnote-data-fuji.c
@@ -68,7 +68,7 @@ exif_mnote_data_fuji_get_value (ExifMnoteData *d, unsigned int i, char *val, uns
 	ExifMnoteDataFuji *n = (ExifMnoteDataFuji *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) return NULL;
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji",
 		  "Querying value for tag '%s'...",
diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
index 3dbe1d3..6067b9e 100644
--- a/libexif/olympus/exif-mnote-data-olympus.c
+++ b/libexif/olympus/exif-mnote-data-olympus.c
@@ -76,7 +76,7 @@ exif_mnote_data_olympus_get_value (ExifMnoteData *d, unsigned int i, char *val,
 	ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) d;
 
 	if (!d || !val) return NULL;
-	if (i > n->count -1) return NULL;
+	if (i >= n->count) return NULL;
 /*
 	exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus",
 		  "Querying value for tag '%s'...",
-- 
2.45.4