Out of bound read in exif_process_IFD_in_MAKERNOTE

I have found some vulnerable code that lacks check size of buffer may lead to memory out of read or write.

static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, char *offset_base, size_t IFDlength, size_t displacement)
{
*****SNIP*******
	switch (maker_note->offset_mode) {
		case MN_OFFSET_MAKER:
			offset_base = value_ptr;
			break;
		case …