Comfy-Org / Comfy-Org/ComfyUI_frontend

Guard malformed EXIF chunks before calling parseExifData in getWebpMetadata

Open
#11,340 0 comments 0 reactions 1 assignee Claimed by @pythongosssss View on GitHub
Potential Bug
Dominant language
TypeScript
Stars
2k
Forks
702
Avg merge
1d 8h
Merged PRs (30d)
512

Description

## Summary

In `src/scripts/pnginfo.ts`, the `getWebpMetadata` function passes potentially truncated or malformed EXIF payloads directly into `parseExifData` without validation. After stripping the optional `Exif\0\0` prefix, a prefix-only or truncated EXIF payload still flows into `parseExifData`, which reads TIFF fields unconditionally and can throw on bad input. This causes malformed WEBP metadata to crash instead of falling back to `{}`.

## Proposed Fix

1. Add a minimum-length check (e.g., `exifLength < 8`) after stripping the prefix and skip/warn if the chunk is too short.
2. Wrap the `parseExifData` call in a `try/catch` block that logs a warning and breaks on any thrown error, rather than propagating the exception.
3. Use strict equality (`===`) for the `'Exif\0\0'` comparison.

## References

- Identified in PR #11307 (review comment): https://github.com/Comfy-Org/ComfyUI_frontend/pull/11307#discussion_r3094372761
- Requested by @pythongosssss as a follow-up task.

┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-11340-Guard-malformed-EXIF-chunks-before-calling-parseExifData-in-getWebpMetadata-3456d73d365081e49c73cc0a764bd40f) by [Unito](https://www.unito.io)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.