From 19e31a6a374780d760d4a4e8b276cf80427c39e1 Mon Sep 17 00:00:00 2001
From: Googler <no-reply@google.com>
Date: Wed, 2 Sep 2026 09:34:51 -0700
Subject: [PATCH] [security/exif] Improve memory safety profile of Exif and
 Field bindings

PiperOrigin-RevId: 975173969
---
 kamadak_exif/exif_bridge.cc |  6 +++---
 kamadak_exif/exif_bridge.h  | 15 ++++++++++-----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/kamadak_exif/exif_bridge.cc b/kamadak_exif/exif_bridge.cc
index d3e29f0..7c3e985 100644
--- a/kamadak_exif/exif_bridge.cc
+++ b/kamadak_exif/exif_bridge.cc
@@ -511,15 +511,15 @@ Exif::Exif(rust::reader::Exif exif) : exif_(std::move(exif)) {
   mnote_fields_ = std::move(mnote_fields);
 }
 
-absl::Span<const uint8_t> Exif::buf() const {
+absl::Span<const uint8_t> Exif::buf() const& {
   return absl::Span<const uint8_t>(buf_);
 }
 
-absl::Span<const Field> Exif::fields() const {
+absl::Span<const Field> Exif::fields() const& {
   return absl::Span<const Field>(fields_);
 }
 
-absl::Span<const Field> Exif::mnote_fields() const {
+absl::Span<const Field> Exif::mnote_fields() const& {
   return absl::Span<const Field>(mnote_fields_);
 }
 
diff --git a/kamadak_exif/exif_bridge.h b/kamadak_exif/exif_bridge.h
index b52f8f4..a751033 100644
--- a/kamadak_exif/exif_bridge.h
+++ b/kamadak_exif/exif_bridge.h
@@ -473,7 +473,8 @@ class Field {
   /**
    * The value of this field.
    */
-  const Value& value() const ABSL_ATTRIBUTE_LIFETIME_BOUND { return value_; };
+  const Value& value() const& ABSL_ATTRIBUTE_LIFETIME_BOUND { return value_; }
+  const Value& value() const&& = delete;
 
  private:
   friend class Exif;
@@ -504,17 +505,20 @@ class Exif final {
   /**
    * Returns the slice that contains the TIFF data.
    */
-  absl::Span<const uint8_t> buf() const ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const uint8_t> buf() const& ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const uint8_t> buf() const&& = delete;
 
   /**
    * Returns a span of Exif fields.
    */
-  absl::Span<const Field> fields() const ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const Field> fields() const& ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const Field> fields() const&& = delete;
 
   /**
    * Returns a span of MakerNote fields.
    */
-  absl::Span<const Field> mnote_fields() const ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const Field> mnote_fields() const& ABSL_ATTRIBUTE_LIFETIME_BOUND;
+  absl::Span<const Field> mnote_fields() const&& = delete;
 
   /**
    * Returns true if the Exif data (TIFF structure) is in the
@@ -604,9 +608,10 @@ class ExifBytes final {
   /**
    * Returns a view to the Exif data.
    */
-  absl::Span<const uint8_t> view() const ABSL_ATTRIBUTE_LIFETIME_BOUND {
+  absl::Span<const uint8_t> view() const& ABSL_ATTRIBUTE_LIFETIME_BOUND {
     return absl::Span<const uint8_t>(vec_.as_ptr(), vec_.len());
   }
+  absl::Span<const uint8_t> view() const&& = delete;
 
  private:
   friend class Writer;