Bug #72682 [Asn->Csd]: exif_read_data() fails to read all data for some images

Edit report at https://bugs.php.net/bug.php?id=72682&edit=1 ID: 72682 Updated by: kalle@php.net Reported by: r dot helm at helm-software dot de Summary: exif_read_data() fails to read all data for some images -Status: Assigned +Status: Closed Type: Bug Package: EXIF related PHP Version: 7.0.9 Assigned To: kalle Block user comment: N Private report: N New Comment: Automatic comment on behalf of kalle Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6 Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images) Previous Comments: ------------------------------------------------------------------------ [2016-08-03 13:51:09] r dot helm at helm-software dot de It's not fixed. Take a look at my previous comment. In exif_process_IFD_in_MAKERNOTE() it goes through maker_note_array to see if it knowns how to parse the makernote of this image. If it doesn't find anything it returns FALSE, which was probably intended to mean that it did not process the makernote. Previously the result of this function was ignored but now when it returns false parsing is stopped. So i think it should return TRUE. ------------------------------------------------------------------------ [2016-08-03 10:02:49] kalle@php.net Please try using this snapshot: http://snaps.php.net/php-trunk-latest.tar.gz For Windows: http://windows.php.net/snapshots/ Gonna steal this one from you Stas. Me and @remi are working on a patch to hopefully resolve this, along with a few other EXIF related bugs at the same time. ------------------------------------------------------------------------ [2016-07-29 11:56:12] r dot helm at helm-software dot de I did some debugging and found that with my test image exif_process_IFD_in_MAKERNOTE() returns FALSE here: https://github.com/php/php-src/blob/9d582eba7448f1495fae62b13d95d2844ce6b28a/ext/exif/exif.c#L2716 And then the conditional added in that commit (https://github.com/php/php-src/commit/eebcbd5de38a0f1c2876035402cb770e37476519#diff-c163453976b65334f071d1d4f976ef45R3086) gets executed and will stop further parsing. Maybe it should return TRUE at that point because this is not a parsing error? ------------------------------------------------------------------------ [2016-07-28 04:44:11] laruence@php.net seems caused by this commit: Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE eebcbd5de38a0f1c2876035402cb770e37476519 Stas, could you please take a look? thanks ------------------------------------------------------------------------ [2016-07-26 17:50:45] r dot helm at helm-software dot de Description: ------------ Since version 7.0.9 exif_read_data() fails to read out all the tags and sections for some images, e.g. images shot with a DJI drone. Example image: http://hs12.de/exif/image.jpg The expected result comes from running the script with php version 7.0.8. The actual result comes from 7.0.9. This was most likely caused by one of the exif changes in 7.0.9: #72603 Out of bound read in exif_process_IFD_in_MAKERNOTE #72618 NULL Pointer Dereference in exif_process_user_comment So it probably has to do with the makernote or usercomment tags that are in these images. Test script: --------------- <?php $exif = exif_read_data("image.jpg", null, true); var_dump($exif); Expected result: ---------------- array(8) { ["FILE"]=> array(6) { ["FileName"]=> string(9) "image.jpg" ["FileDateTime"]=> int(1469549406) ["FileSize"]=> int(5199843) ["FileType"]=> int(2) ["MimeType"]=> string(10) "image/jpeg" ["SectionsFound"]=> string(51) "ANY_TAG, IFD0, THUMBNAIL, EXIF, GPS, INTEROP, WINXP" } ["COMPUTED"]=> array(8) { ["html"]=> string(26) "width="4000" height="3000"" ["Height"]=> int(3000) ["Width"]=> int(4000) ["IsColor"]=> int(1) ["ByteOrderMotorola"]=> int(0) ["ApertureFNumber"]=> string(5) "f/2.8" ["Thumbnail.FileType"]=> int(2) ["Thumbnail.MimeType"]=> string(10) "image/jpeg" } ["IFD0"]=> array(14) { ["ImageDescription"]=> string(26) "DCIM\100MEDIA\DJI_0413.JPG" ["Make"]=> string(3) "DJI" ["Model"]=> string(6) "FC300X" ["Orientation"]=> int(1) ["XResolution"]=> string(4) "72/1" ["YResolution"]=> string(4) "72/1" ["ResolutionUnit"]=> int(2) ["Software"]=> string(11) "v01.30.5036" ["DateTime"]=> string(19) "2016:07:26 11:32:59" ["YCbCrPositioning"]=> int(1) ["Exif_IFD_Pointer"]=> int(182) ["GPS_IFD_Pointer"]=> int(686) ["Comments"]=> string(128) "0�.�9�.�1�3�8�������������������������������������������������������������������������������������������������������������������" ["Keywords"]=> string(16) "N���������������" } ["THUMBNAIL"]=> array(6) { ["Compression"]=> int(6) ["XResolution"]=> string(4) "72/1" ["YResolution"]=> string(4) "72/1" ["ResolutionUnit"]=> int(2) ["JPEGInterchangeFormat"]=> int(41972) ["JPEGInterchangeFormatLength"]=> int(8065) } ["EXIF"]=> array(39) { ["ExposureTime"]=> string(12) "1206/1000000" ["FNumber"]=> string(7) "280/100" ["ExposureProgram"]=> int(2) ["ISOSpeedRatings"]=> int(100) ["ExifVersion"]=> string(4) "0230" ["DateTimeOriginal"]=> string(19) "2016:07:26 11:32:59" ["DateTimeDigitized"]=> string(19) "2016:07:26 11:32:59" ["ComponentsConfiguration"]=> string(4) "�
" ["CompressedBitsPerPixel"]=> string(15) "4861324/1500000" ["ShutterSpeedValue"]=> string(11) "-9695/-1000" ["ApertureValue"]=> string(7) "200/100" ["ExposureBiasValue"]=> string(6) "-11/32" ["MaxApertureValue"]=> string(7) "200/100" ["SubjectDistance"]=> string(5) "0/100" ["MeteringMode"]=> int(2) ["LightSource"]=> int(1) ["Flash"]=> int(32) ["FocalLength"]=> string(7) "361/100" ["MakerNote"]=> string(256) "�
�����DJI��
����
�����
�����̽��
�����L���
���������
���ff����
�������
���33� ��
����̳� ��
���f����
���������������������������������������������������������������������������������������������������������������������������������" ["FlashPixVersion"]=> string(4) "0010" ["ColorSpace"]=> int(1) ["ExifImageWidth"]=> int(4000) ["ExifImageLength"]=> int(3000) ["InteroperabilityOffset"]=> int(656) ["ExposureIndex"]=> string(3) "0/0" ["FileSource"]=> string(1) "" ["SceneType"]=> string(1) "�" ["CustomRendered"]=> int(0) ["ExposureMode"]=> int(0) ["WhiteBalance"]=> int(0) ["DigitalZoomRatio"]=> string(3) "0/0" ["FocalLengthIn35mmFilm"]=> int(20) ["SceneCaptureType"]=> int(0) ["GainControl"]=> int(0) ["Contrast"]=> int(0) ["Saturation"]=> int(0) ["Sharpness"]=> int(0) ["DeviceSettingDescription"]=> string(4) "����" ["SubjectDistanceRange"]=> int(0) } ["GPS"]=> array(7) { ["GPSVersion"]=> string(4) "��" ["GPSLatitudeRef"]=> string(1) "N" ["GPSLatitude"]=> array(3) { [0]=> string(4) "50/1" [1]=> string(3) "1/1" [2]=> string(12) "185831/10000" } ["GPSLongitudeRef"]=> string(1) "E" ["GPSLongitude"]=> array(3) { [0]=> string(4) "10/1" [1]=> string(3) "9/1" [2]=> string(12) "435465/10000" } ["GPSAltitudeRef"]=> string(1) "�" ["GPSAltitude"]=> string(11) "177330/1000" } ["INTEROP"]=> array(2) { ["InterOperabilityIndex"]=> string(3) "R98" ["InterOperabilityVersion"]=> string(4) "0100" } ["WINXP"]=> array(2) { ["Comments"]=> string(1) "0" ["Keywords"]=> string(1) "N" } } Actual result: -------------- array(4) { ["FILE"]=> array(6) { ["FileName"]=> string(9) "image.jpg" ["FileDateTime"]=> int(1469549406) ["FileSize"]=> int(5199843) ["FileType"]=> int(2) ["MimeType"]=> string(10) "image/jpeg" ["SectionsFound"]=> string(19) "ANY_TAG, IFD0, EXIF" } ["COMPUTED"]=> array(6) { ["html"]=> string(26) "width="4000" height="3000"" ["Height"]=> int(3000) ["Width"]=> int(4000) ["IsColor"]=> int(1) ["ByteOrderMotorola"]=> int(0) ["ApertureFNumber"]=> string(5) "f/2.8" } ["IFD0"]=> array(10) { ["ImageDescription"]=> string(26) "DCIM\100MEDIA\DJI_0413.JPG" ["Make"]=> string(3) "DJI" ["Model"]=> string(6) "FC300X" ["Orientation"]=> int(1) ["XResolution"]=> string(4) "72/1" ["YResolution"]=> string(4) "72/1" ["ResolutionUnit"]=> int(2) ["Software"]=> string(11) "v01.30.5036" ["DateTime"]=> string(19) "2016:07:26 11:32:59" ["YCbCrPositioning"]=> int(1) } ["EXIF"]=> array(18) { ["ExposureTime"]=> string(12) "1206/1000000" ["FNumber"]=> string(7) "280/100" ["ExposureProgram"]=> int(2) ["ISOSpeedRatings"]=> int(100) ["ExifVersion"]=> string(4) "0230" ["DateTimeOriginal"]=> string(19) "2016:07:26 11:32:59" ["DateTimeDigitized"]=> string(19) "2016:07:26 11:32:59" ["ComponentsConfiguration"]=> string(4) "�
" ["CompressedBitsPerPixel"]=> string(15) "4861324/1500000" ["ShutterSpeedValue"]=> string(11) "-9695/-1000" ["ApertureValue"]=> string(7) "200/100" ["ExposureBiasValue"]=> string(6) "-11/32" ["MaxApertureValue"]=> string(7) "200/100" ["SubjectDistance"]=> string(5) "0/100" ["MeteringMode"]=> int(2) ["LightSource"]=> int(1) ["Flash"]=> int(32) ["FocalLength"]=> string(7) "361/100" } } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72682&edit=1