Re: svn: /php/php-src/ branches/PHP_5_3/ext/exif/exif.c branches/PHP_5_3/ext/exif/tests/bug54002.phpt branches/PHP_5_3/ext/exif/tests/bug54002_1.jpeg
branches/PHP_5_3/ext/exif/tests/bug54002_2.jpeg trunk/ext/exif/exif.c trunk/ext/exif/tests

On 02/15/2011 03:31 PM, Pierre Joye wrote:

On Tue, Feb 15, 2011 at 12:54 PM, Dmitry Stogov<dmitry@zend.com> wrote:

I don't know all the logic but it looks very strange 2147483648 == 0x80000000 != 0x7fffffff == 2147483647 so byte_count_signed may be 0x80000000 == -1

negative value are checked before. Btw, byte_count_signed is a 64bit signed integer, for this reason :)

Lets byte_count_signed = 0x0000000080000000 it's not less than zero and not greater than 2147483648. So the following condition is false. if (byte_count_signed < 0 || (byte_count_signed > 2147483648)) { Then you convert it to size_t. byte_count = (size_t)byte_count_signed; In case size_t is defined as signed int32 you will get byte_count = -1. Thanks. Dmitry

Cheers,