com php-src: Merge branch 'bug67250' into PHP-5.4: ext/standard/iptc.c
| From: | Stanislav Malyshev | Date: | Tue, 13 May 2014 23:43:10 +0000 |
| Subject: | com php-src: Merge branch 'bug67250' into PHP-5.4: ext/standard/iptc.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-78329@lists.php.net to get a copy of this message | ||
Commit: 9103c9eb4fccfa5f71283c0e631285252af95e5e
Author: Stanislav Malyshev <stas@php.net> Tue, 13 May 2014 16:42:23 -0700
Parents: 3e276d6728b95060352a507cf890a8bec60f3062 3e9cb6a4a5504c888f185a5ab7d1cc02cc359cbe
Branches: PHP-5.4 PHP-5.5 PHP-5.6 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9103c9eb4fccfa5f71283c0e631285252af95e5e
Log:
Merge branch 'bug67250' into PHP-5.4
* bug67250:
Fix bug #67250 (iptcparse out-of-bounds read)
Bugs:
https://bugs.php.net/67250
Changed paths:
MM ext/standard/iptc.c
Diff:
diff --cc ext/standard/iptc.c
index 3257339,d2c14c9..ad4fa65
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@@ -329,6 -329,9 +329,9 @@@ PHP_FUNCTION(iptcparse
recnum = buffer[ inx++ ];
if (buffer[ inx ] & (unsigned char) 0x80) { /* long tag */
- if((inx+6) >= str_len) {
- break;
- }
++ if((inx+6) >= str_len) {
++ break;
++ }
len = (((long) buffer[ inx + 2 ]) << 24) + (((long) buffer[ inx + 3 ]) << 16) +
(((long) buffer[ inx + 4 ]) << 8) + (((long) buffer[ inx + 5 ]));
inx += 6;