com php-src: Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with correct exif format): NEWS ext/exif/exif.c ext/exif/te
sts/bug74428/bug74428.jpg ext/exif/test s/bug74428/bug74428.phpt

Commit: 900ce92c9af9ad8616a4a698e5ffd2a957c1f547 Author: Kalle Sommer Nielsen <kalle@php.net> Fri, 7 Jul 2017 10:20:02 +0200 Parents: 57432da0b9de3cbf7353fb79a30c55facdd10ba1 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=900ce92c9af9ad8616a4a698e5ffd2a957c1f547 Log: Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with correct exif format) Bugs: https://bugs.php.net/74428 Changed paths: M NEWS M ext/exif/exif.c A ext/exif/tests/bug74428/bug74428.jpg A ext/exif/tests/bug74428/bug74428.phpt Diff: diff --git a/NEWS b/NEWS index 8a05976..a088bd7 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,10 @@ PHP NEWS unserialize). (Nikita) . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via php_parse_date()). (Derick) + +- EXIF: + . Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with + correct exif format). (bradpiccho at gmail dot com, Kalle) - GD: . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index ab92022...a75c0ba 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3553,7 +3553,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, ImageInfo->sections_found |= FOUND_IFD0; - if ((dir_start + 2) >= (offset_base+IFDlength)) { + if ((dir_start + 2) > (offset_base+IFDlength)) { exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size"); return FALSE; } @@ -3581,7 +3581,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, * Hack to make it process IDF1 I hope * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail */ - if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) { + if ((dir_start+2+12*de + 4) > (offset_base+IFDlength)) { exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size"); return FALSE; } diff --git a/ext/exif/tests/bug74428/bug74428.jpg b/ext/exif/tests/bug74428/bug74428.jpg new file mode 100644 index 0000000..73c7805 Binary files /dev/null and b/ext/exif/tests/bug74428/bug74428.jpg differ diff --git a/ext/exif/tests/bug74428/bug74428.phpt b/ext/exif/tests/bug74428/bug74428.phpt new file mode 100644 index 0000000..b2beca3 --- /dev/null +++ b/ext/exif/tests/bug74428/bug74428.phpt @@ -0,0 +1,50 @@ +--TEST-- +Bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with correct exif format) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--INI-- +output_handler= +zlib.output_compression=0 +--FILE-- +<?php +$infile = dirname(__FILE__).'/bug74428.jpg'; +var_dump(exif_read_data($infile)); +?> +===DONE=== +--EXPECTF-- +array(11) { + ["FileName"]=> + string(12) "bug74428.jpg" + ["FileDateTime"]=> + int(%d) + ["FileSize"]=> + int(1902) + ["FileType"]=> + int(2) + ["MimeType"]=> + string(10) "image/jpeg" + ["SectionsFound"]=> + string(19) "ANY_TAG, IFD0, EXIF" + ["COMPUTED"]=> + array(5) { + ["html"]=> + string(22) "width="88" height="28"" + ["Height"]=> + int(28) + ["Width"]=> + int(88) + ["IsColor"]=> + int(1) + ["ByteOrderMotorola"]=> + int(0) + } + ["Orientation"]=> + int(1) + ["Exif_IFD_Pointer"]=> + int(38) + ["ExifImageWidth"]=> + int(88) + ["ExifImageLength"]=> + int(28) +} +===DONE===