com php-src: Fix #50845: exif_process_IFD_TAG: Use the right offset if reading from stream: NEWS ext/exif/exif.c ext/exif/tests/bug50845.jpg
ext/exif/tests/bug50845.phpt

Commit: 1ab5a1b432a4b4c62171864bd1b545616e1b07db Author: Bartosz Dziewoński <matma.rex@gmail.com> Tue, 14 Jun 2016 13:27:56 +0200 Committer: Stanislav Malyshev <stas@php.net> Tue, 14 Jun 2016 10:48:08 -0700 Parents: 4c968c6ddd2d3eb46838db153264edf5c7b3fefa Branches: PHP-5.6 PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=1ab5a1b432a4b4c62171864bd1b545616e1b07db Log: Fix #50845: exif_process_IFD_TAG: Use the right offset if reading from stream When the location of the data is outside of the range we have preloaded (for example, if it's before the beginning of the IFD structure), we have to read it from the stream into a separate buffer. The offset calculations in this case were incorrect, resulting in bogus values being read for the affected fields (sometimes parts of other fields, sometimes binary data). The included test image, sourced from [1], is in the public domain. [1] https://commons.wikimedia.org/wiki/File:U.S._Marines_Prepare_to_board_an_MV-22_Osprey_160509-M-AF202-041.jpg Bugs: https://bugs.php.net/50845 Changed paths: M NEWS M ext/exif/exif.c A ext/exif/tests/bug50845.jpg A ext/exif/tests/bug50845.phpt Diff: diff --git a/NEWS b/NEWS index 3b0153b..61a5be2 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,10 @@ PHP NEWS - Core: . Fix bug #72138 (Integer Overflow in Length of String-typed ZVAL). (Stas) +- EXIF: + . Fixed bug #50845 (exif_read_data() returns corrupted exif headers). + (Bartosz Dziewoński) + - OpenSSL: . Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe). (Jakub Zelenka) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index db007ca..1ff4b4b 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2878,11 +2878,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha } fpos = php_stream_tell(ImageInfo->infile); - php_stream_seek(ImageInfo->infile, offset_val, SEEK_SET); + php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET); fgot = php_stream_tell(ImageInfo->infile); - if (fgot!=offset_val) { + if (fgot!=displacement+offset_val) { EFREE_IF(outside); - exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, offset_val); + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val); return FALSE; } fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count); diff --git a/ext/exif/tests/bug50845.jpg b/ext/exif/tests/bug50845.jpg new file mode 100644 index 0000000..d30137b Binary files /dev/null and b/ext/exif/tests/bug50845.jpg differ diff --git a/ext/exif/tests/bug50845.phpt b/ext/exif/tests/bug50845.phpt new file mode 100644 index 0000000..2c14223 --- /dev/null +++ b/ext/exif/tests/bug50845.phpt @@ -0,0 +1,140 @@ +--TEST-- +Bug #50845 (exif_read_data() returns corrupted exif headers) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php +$infile = dirname(__FILE__).'/bug50845.jpg'; +var_dump(exif_read_data($infile)); +--EXPECTF-- +array(44) { + ["FileName"]=> + string(12) "bug50845.jpg" + ["FileDateTime"]=> + int(%d) + ["FileSize"]=> + int(803603) + ["FileType"]=> + int(2) + ["MimeType"]=> + string(10) "image/jpeg" + ["SectionsFound"]=> + string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF" + ["COMPUTED"]=> + array(9) { + ["html"]=> + string(26) "width="5472" height="3648"" + ["Height"]=> + int(3648) + ["Width"]=> + int(5472) + ["IsColor"]=> + int(1) + ["ByteOrderMotorola"]=> + int(0) + ["ApertureFNumber"]=> + string(5) "f/7.1" + ["Copyright"]=> + string(13) "Public Domain" + ["Thumbnail.FileType"]=> + int(2) + ["Thumbnail.MimeType"]=> + string(10) "image/jpeg" + } + ["ImageDescription"]=> + string(295) "A U.S. Marine Corps MV-22 Osprey lands on the USS Whidbey Island (LSD-41), May 5, 2016. The vehicles were loaded to support a theater security cooperation event as a part of a MEU readiness exercise. (U.S. Marine Corps photo by Lance Cpl. Koby I. Saunders/22 Marine Expeditionary Unit/ Released)" + ["Make"]=> + string(5) "Canon" + ["Model"]=> + string(22) "Canon EOS-1D X Mark II" + ["Orientation"]=> + int(1) + ["XResolution"]=> + string(5) "240/1" + ["YResolution"]=> + string(5) "240/1" + ["ResolutionUnit"]=> + int(2) + ["Artist"]=> + string(24) "Lance Cpl. Koby Saunders" + ["Copyright"]=> + string(13) "Public Domain" + ["Exif_IFD_Pointer"]=> + int(12572) + ["THUMBNAIL"]=> + array(6) { + ["Compression"]=> + int(6) + ["XResolution"]=> + string(5) "240/1" + ["YResolution"]=> + string(5) "240/1" + ["ResolutionUnit"]=> + int(2) + ["JPEGInterchangeFormat"]=> + int(860) + ["JPEGInterchangeFormatLength"]=> + int(11204) + } + ["ExposureTime"]=> + string(5) "1/200" + ["FNumber"]=> + string(5) "71/10" + ["ExposureProgram"]=> + int(1) + ["ISOSpeedRatings"]=> + int(100) + ["UndefinedTag:0x8830"]=> + int(2) + ["UndefinedTag:0x8832"]=> + int(100) + ["ExifVersion"]=> + string(4) "0230" + ["ShutterSpeedValue"]=> + string(15) "7643856/1000000" + ["ApertureValue"]=> + string(15) "5655638/1000000" + ["ExposureBiasValue"]=> + string(3) "0/1" + ["MaxApertureValue"]=> + string(3) "4/1" + ["MeteringMode"]=> + int(5) + ["Flash"]=> + int(16) + ["FocalLength"]=> + string(4) "24/1" + ["ColorSpace"]=> + int(65535) + ["FocalPlaneXResolution"]=> + string(12) "5472000/1438" + ["FocalPlaneYResolution"]=> + string(11) "3648000/958" + ["FocalPlaneResolutionUnit"]=> + int(2) + ["CustomRendered"]=> + int(0) + ["ExposureMode"]=> + int(1) + ["WhiteBalance"]=> + int(0) + ["SceneCaptureType"]=> + int(0) + ["UndefinedTag:0xA431"]=> + string(12) "002099000358" + ["UndefinedTag:0xA432"]=> + array(4) { + [0]=> + string(4) "24/1" + [1]=> + string(5) "105/1" + [2]=> + string(3) "0/0" + [3]=> + string(3) "0/0" + } + ["UndefinedTag:0xA434"]=> + string(22) "EF24-105mm f/4L IS USM" + ["UndefinedTag:0xA435"]=> + string(10) "000044bc4c" +}