I AirDropped the PoC to my vulnerable iPhone. It didn't cause a crash until I tried to edit it in the Photos app.
The DNG file did have the 01 byte at `2FD00` (from xxd or hexdump -C). However it didn't have a byte position `3E40B`. I tried searching and there is literally no entry at that position. I found a 02 value at 3e40 but not at 3e40b. Is this a typo?
Where did you find it to try and repro?
Did you find a 02 at 3E40B? I found 01 at 2FD00, but there was no 3E40B byte position entry.
I did find something similar at 00003e40: 00003e40 02 00 04 00 0a 00 00 00 30 01 00 00 00 00 00 00 |........0.......|
dd status=none if=IMGP0847.DNG bs=1 skip=0x3e40b count=1 | xxd
00000000: 02Curious if you (clearly smarter than me) know why it didn't show correctly in the xxd or hexdump for the file. Would love to learn.
xxd IMGP0847.DNG | grep 03e400:
0003e400: ffd8 ffc3 000e 0e10 800c 5002 0011 0001 ..........P.....