$OpenBSD: patch-gdk-pixbuf_io-jpeg_c,v 1.1 2013/02/02 09:24:08 ajacoutot Exp $

From ff9d69d5328abd846b2c66e3ed5ad0e90de8f5d8 Mon Sep 17 00:00:00 2001
From: Tormod Volden <debian.tormod@gmail.com>
Date: Thu, 15 Nov 2012 20:17:29 +0000
Subject: Fix parsing of JPEG orientation tag

--- gdk-pixbuf/io-jpeg.c.orig	Mon Sep  3 18:16:55 2012
+++ gdk-pixbuf/io-jpeg.c	Sat Feb  2 10:20:08 2013
@@ -393,9 +393,6 @@ jpeg_parse_exif_app1 (JpegExifContext *context, jpeg_s
 	guint ret = FALSE;
 	guint offset;
 	guint tags;	   /* number of tags in current ifd */
-	guint tag;
-	guint type;
-	guint count;
 	guint endian = 0;	/* detected endian of data */
 	const char leth[]  = {0x49, 0x49, 0x2a, 0x00};	// Little endian TIFF header
 	const char beth[]  = {0x4d, 0x4d, 0x00, 0x2a};	// Big endian TIFF header
@@ -472,10 +469,11 @@ jpeg_parse_exif_app1 (JpegExifContext *context, jpeg_s
 
 	/* check through IFD0 for tags */
 	while (tags--){
-		tag    = de_get16(&marker->data[i + 0], endian);
-		type   = de_get16(&marker->data[i + 2], endian);
-		count  = de_get32(&marker->data[i + 4], endian);
-		offset = de_get32(&marker->data[i + 8], endian);
+		guint tag   = de_get16(&marker->data[i + 0], endian);
+		guint type  = de_get16(&marker->data[i + 2], endian);
+		guint count = de_get32(&marker->data[i + 4], endian);
+		/* values of types small enough to fit are stored directly in the (first) bytes of the Value Offset field */
+		guint short_value = de_get16(&marker->data[i + 8], endian);
 
 		/* orientation tag? */
 		if (tag == 0x112){
@@ -485,7 +483,7 @@ jpeg_parse_exif_app1 (JpegExifContext *context, jpeg_s
 				continue;
 
 			/* get the orientation value */
-			context->orientation = offset <= 8 ? offset : 0;
+			context->orientation = short_value <= 8 ? short_value : 0;
 		}
 		/* move the pointer to the next 12-byte tag field. */
 		i = i + 12;
