Bug #15174: JPEG SOFn marker incompletely read

From: mul@rentapacs.com Operating system: Linux PHP version: 4.1.1 PHP Bug Type: GetImageSize related Bug description: JPEG SOFn marker incompletely read In ext/standard/image.c:static struct gfxinfo *php_handle_jpeg(): After $result->channels has been read from the file, there are still $result->channels * 3 bytes left in the SOF marker. These bytes have to be read to synchronize reading of the following markers in the JPEG stream. If not, bogus markers will be decoded and SOS marker will be missed in most cases. The following patch against 4.1.1 might take care of the problem: --- ext/standard/image.c.orig Sat Aug 11 19:03:37 2001 +++ ext/standard/image.c Tue Jan 22 21:14:31 2002 @@ -323,6 +323,8 @@ unsigned int marker; char tmp[2]; unsigned char a[4]; + unsigned short skip; + unsigned char *buffer; for (;;) { marker = php_next_marker(socketd, fp, issock); @@ -349,6 +351,11 @@ result->height = (((unsigned short) a[ 0 ]) << 8) + ((unsigned short) a[ 1 ]); result->width = (((unsigned short) a[ 2 ]) << 8) + ((unsigned short) a[ 3 ]); result->channels = FP_FGETC(socketd, fp, issock); + /* skip component specification parameters */ + skip = result->channels * 3; + buffer = emalloc(skip); + FP_FREAD(buffer, (long) skip, socketd, fp, issock); + efree(buffer); if (! info) /* if we don't want an extanded info -> return */ return result; -- Edit bug report at: http://bugs.php.net/?id=15174&edit=1