File Browser Exif parser: support more exotic format variants

chrome/browser/resources/file_manager/js/exif_parser.js

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 const EXIF_MARK_SOI = 0xffd8;  // Start of image data.
 const EXIF_MARK_SOS = 0xffda;  // Start of "stream" (the actual image data).
 const EXIF_MARK_SOF = 0xffc0;  // Start of "frame"
 const EXIF_MARK_EXIF = 0xffe1;  // Start of exif block.
 
 const EXIF_ALIGN_LITTLE = 0x4949;  // Indicates little endian exif data.
@@ skipping 67 matching lines @@
 
       var mark = this.readMark(br);
       if (mark == EXIF_MARK_SOS)
         throw new Error('SOS marker found before SOF');
 
       var markLength = this.readMarkLength(br);
 
       var nextSectionStart = br.tell() + markLength;
       if (!br.canRead(markLength)) {
         // Get the entire section.
+        if (filePos + br.tell() + markLength > file.size) {
+          throw new Error(
+              'Invalid section length @' + (filePos + br.tell() - 2));
+        }
         reread(-4, markLength + 4);
         return;
       }
 
       if (mark == EXIF_MARK_EXIF) {
         this.parseExifSection(metadata, buf, br);
-      } else if (mark == EXIF_MARK_SOF) {
+      } else if ((mark & ~0xF) == EXIF_MARK_SOF) {
         // The most reliable size information is encoded in the SOF section.
+        // There are 16 variants of the SOF format distinguished by the last
+        // hex digit of the mark, but the part we want is always the same.
         br.seek(1, ByteReader.SEEK_CUR); // Skip the precision byte.
         var height = br.readScalar(2);
         var width = br.readScalar(2);
         ExifParser.setImageSize(metadata, width, height);
         callback(metadata);  // We are done!
         return;
       }
 
       br.seek(nextSectionStart, ByteReader.SEEK_BEG);
     }
@@ skipping 236 matching lines @@
     return {
       scaleX: ExifParser.SCALEX[index],
       scaleY: ExifParser.SCALEY[index],
       rotate90: ExifParser.ROTATE90[index]
     }
   }
   return null;
 };
 
 MetadataDispatcher.registerParserClass(ExifParser);