com php-src: Merge branch 'PHP-5.6': ext/exif/exif.c

Commit: b16fdebcf8f59e5aa09c11782c05224762ca835e Author: Stanislav Malyshev <stas@php.net> Tue, 20 Jan 2015 10:41:59 -0800 Parents: ea8415114a9299f6ba7df16c882e6d9d328af054 e18ec956873d1cc1fcd4647f4a218c25d0f80209 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b16fdebcf8f59e5aa09c11782c05224762ca835e Log: Merge branch 'PHP-5.6' * PHP-5.6: 5.4.38 next Updated NEWS Updated NEWS Fix bug #68711 Remove useless checks. 'num' is unsigned and cannot be <0. Fix bug #68799: Free called on unitialized pointer Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize()) Conflicts: ext/exif/exif.c ext/standard/var_unserializer.c ext/standard/var_unserializer.re Bugs: https://bugs.php.net/68711 https://bugs.php.net/68799 https://bugs.php.net/68710 Changed paths: MM ext/exif/exif.c Diff: diff --cc ext/exif/exif.c index d889db0,5504545..0e25a05 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@@ -2692,19 -2689,19 +2692,19 @@@ static int exif_process_user_comment(im /* {{{ exif_process_unicode * Process unicode field in IFD. */ -static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC) +static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount) { - xp_field->tag = tag; + xp_field->tag = tag; - + xp_field->value = NULL; /* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */ if (zend_multibyte_encoding_converter( - (unsigned char**)&xp_field->value, - &xp_field->size, + (unsigned char**)&xp_field->value, + &xp_field->size, (unsigned char*)szValuePtr, ByteCount, - zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC), - zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le TSRMLS_CC) - TSRMLS_CC) == (size_t)-1) { + zend_multibyte_fetch_encoding(ImageInfo->encode_unicode), + zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le) + ) == (size_t)-1) { xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount); } return xp_field->size;