Bug #66147 [Opn->Ver]: exif_read_data causes segmentation fault on some JPEG files with EXIF

Edit report at https://bugs.php.net/bug.php?id=66147&edit=1 ID: 66147 Updated by: cmb@php.net Reported by: stephon at gmail dot com Summary: exif_read_data causes segmentation fault on some JPEG files with EXIF -Status: Open +Status: Verified Type: Bug Package: mbstring related -Operating System: FreeBSD 9.2-Release +Operating System: FreeBSD 9.2-Release,Windows 7 -PHP Version: 5.4.22 +PHP Version: 5.6.8 Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2013-11-22 14:35:17] stephon at gmail dot com Description: ------------ Hello all, We have found that some kind of JPEG files using exif_read_data causes segmentation fault, like the image below: http://people.cs.nctu.edu.tw/~chenbc/php-mbstring-coredump.jpg Our test environment has PHP exif and mbstring extensions enabled. When only exif extension enabled, the scripts works fine. but it cause segmentation fault while both exif and mbstring extension enabled. Here are GDB trace results: > gdb /usr/local/bin/php GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)... (gdb) run test2.php Starting program: /usr/local/bin/php test2.php (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...[New LWP 100417] (no debugging symbols found)...(no debugging symbols found)...[New Thread 1002407400 (LWP 100417/php)] (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)! ...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1002407400 (LWP 100417/php)] 0x0000001003276b9d in mbfl_buffer_converter_new2 () from /usr/local/lib/php/20100525/mbstring.so But in our environment, mbstring is needed for other programs use. Is there any way to keep both exif and mbstring enabled, or how to skip errors while exif_read_data causes problems? Thanks a lot Test script: --------------- #!/usr/local/bin/php <?php $file = 'php-mbstring-coredump.jpg'; $array = exif_read_data($file); print_r($array); exit; Expected result: ---------------- Array ( [FileName] => test2.jpg [FileDateTime] => 1385117776 [FileSize] => 23155 [FileType] => 2 [MimeType] => image/jpeg [SectionsFound] => ANY_TAG, IFD0, EXIF, INTEROP [COMPUTED] => Array ( [html] => width="240" height="320" [Height] => 320 [Width] => 240 [IsColor] => 1 [ByteOrderMotorola] => 1 [ExposureTime] => 0.500 s (1/2) [Copyright] => stephonhaha ) [ImageDescription] => 20090918164650 [Make] => DoCoMo [Model] => L704i [Orientation] => 1 [XResolution] => 72/1 [YResolution] => 72/1 [ResolutionUnit] => 2 [DateTime] => 2009:09:18 17:36:57 [YCbCrPositioning] => 1 [Copyright] => stephonhaha [Exif_IFD_Pointer] => 224 [ExifVersion] => 0220 [DateTimeOriginal] => 2009:09:18 16:48:42 [DateTimeDigitized] => 2009:09:18 17:36:57 [ComponentsConfiguration] => [ShutterSpeedValue] => 1/1 [Flash] => 1 [FocalLength] => 1/1 [MakerNote] => [UserComment] => JISP2009_0918_164842 [FlashPixVersion] => 0100 [ColorSpace] => 1 [ExifImageWidth] => 240 [ExifImageLength] => 320 [InteroperabilityOffset] => 498 [InterOperabilityIndex] => R98 [InterOperabilityVersion] => 0100 ) Actual result: -------------- Segmentation fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66147&edit=1