Update vendored TinyEXIF to 8c22aff

[cinema-ONE]

Updates the vendored TinyEXIF from 6e56015 (April 2021) to 8c22aff (August 2026).

Why

The pinned copy is missing two upstream memory-safety fixes — 841e2929 (heap buffer overflow in EntryParser::Fetch) and b6ea1b7b (integer overflow in the parseString bounds check).

The first is reachable here. Fuzzing the pinned copy under ASan segfaulted after 18 executions:

SEGV on unknown address 0x50c0ffff0b35
  #0 TinyEXIF::EntryParser::parse32                   TinyEXIF.cpp:283
  #1 TinyEXIF::EntryParser::parseRational             TinyEXIF.cpp:297
  #2 TinyEXIF::EntryParser::Fetch(double&, unsigned)  TinyEXIF.cpp:256
  #3 TinyEXIF::EXIFInfo::parseIFDExif                 TinyEXIF.cpp:615

That is exactly the function 841e2929 adds the missing offset + 8 > len check to. EXIF parsing runs whenever Kodi reads tags for a picture, so the input is attacker-controlled.

Worth noting for anyone re-checking this: upstream's published PoC samples do not reproduce it. The older parser rejects them as PARSE_CORRUPT_DATA before reaching that code, so replaying them says "not affected". The crash was found by fuzzing this pinned version specifically.

Verification

	Old (6e56015)	New (8c22aff)
The crash input	SEGV	parses cleanly
Fuzzing under ASan + UBSan	crash at 18 executions	3,306,837 runs, 0 findings

Only parseFrom(), parseFromEXIFSegment(), ImageWidth, ImageHeight and Orientation are used here, all unchanged upstream. Builds clean.

CI will be red, and not because of this

This branch is off Piers, which does not compile against xbmc/xbmc master any more: ImageDecoder API 3.1.0 (xbmc/xbmc#29068) changed the Decode() signature, and CI here builds against master. #71 fixes that, and the two compose — I built this branch on top of it and both compile.

They are independent concerns and can merge in either order.

---

_{Written by my AI co-author (Claude Code); posted from my account.}

[greptile-apps]

Greptile Summary

Updates the vendored TinyEXIF snapshot from 6e56015 to 8c22aff, incorporating upstream parser hardening and API additions.

• Adds overflow-safe bounds checks for attacker-controlled EXIF offsets, lengths, and IFD entries.
• Expands EXIF/XMP metadata parsing and field-presence tracking.
• Updates the vendored headers, documentation, licensing information, and provenance note.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
lib/TinyEXIF/TinyEXIF.cpp	Replaces the vendored parser implementation with the newer upstream snapshot, including bounds-checking and metadata-field tracking changes; no eligible blocking issue remains.
lib/TinyEXIF/TinyEXIF.h	Updates the public vendored declarations and metadata structures to match the newer TinyEXIF snapshot.
lib/TinyEXIF/README.md	Documents the new field-presence API and updates licensing and attribution.
lib/kodi-TinyEXIF-note.txt	Updates the recorded upstream TinyEXIF revision and vendoring information.

_{Reviews (2): Last reviewed commit: "Update vendored TinyEXIF to 8c22aff" | Re-trigger Greptile}

[garbear]

Jenkins not happy?

[cinema-ONE]

Rebased — you were right. My earlier "the red clears once the API PRs merge" was wrong: this branch was still based on the pre-merge Piers, so it carried the old Decode signature and CI kept failing even after that landed. MERGEABLE was true but misleading — no textual conflict, just a stale base.

Now on current Piers and builds clean against the merged API. CI re-running.

---

_{Written by my AI co-author (Claude Code); posted from my account.}

[garbear]

Thanks!