Fix bug #75785 by attempt switching endianness on Maker's Note

Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big refactor and a gigantic lookup
table, this commit simply attempts to switch the
endianness and proceed when values are acceptable.

Closes GH-5849.

diff --git a/NEWS b/NEWS
index 6b85632037b59dab11b09b0d9ef04be30ebd2c55..d79a06a2bb3c6ea89ae5ccb5848bbcd082180822 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
     (cmb)
 
+- Exif:
+  . Fixed bug #75785 (Many errors from exif_read_data).
+    (Níckolas Daniel da Silva)
+
 - Gettext:
   . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
     gettext()). (Florian Engelhardt)

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 4cb36c534bb2e57f5fe1b9d919b28186ddb4c958..5e4c23f4e623bb741ad630e3dc2bd7c09af6305d 100644 (file)
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -66,7 +66,7 @@ typedef unsigned char uchar;
 
 #define EFREE_IF(ptr)  if (ptr) efree(ptr)
 
-#define MAX_IFD_NESTING_LEVEL 150
+#define MAX_IFD_NESTING_LEVEL 200
 
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
@@ -3173,6 +3173,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 
        NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
 
+       /* It can be that motorola_intel is wrongly mapped, let's try inverting it */
+       if ((2+NumDirEntries*12) > value_len) {
+               exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");
+
+               ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
+               NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
+       }
+
+       if ((2+NumDirEntries*12) > value_len) {
+               exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+               return FALSE;
+       }
+       if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+               exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+               return FALSE;
+       }
+
        switch (maker_note->offset_mode) {
                case MN_OFFSET_MAKER:
                        offset_base = value_ptr;
@@ -3203,15 +3220,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
                        break;
        }
 
-       if ((2+NumDirEntries*12) > value_len) {
-               exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
-               return FALSE;
-       }
-       if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-               exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-               return FALSE;
-       }
-
        for (de=0;de<NumDirEntries;de++) {
                size_t offset = 2 + 12 * de;
                if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,

diff --git a/ext/exif/tests/bug75785/P1000506.JPG b/ext/exif/tests/bug75785/P1000506.JPG
new file mode 100644 (file)
index 0000000..3c74b4e
Binary files /dev/null and b/ext/exif/tests/bug75785/P1000506.JPG differ

diff --git a/ext/exif/tests/bug75785/bug75785.phpt b/ext/exif/tests/bug75785/bug75785.phpt
new file mode 100644 (file)
index 0000000..b9f6551
--- /dev/null
+++ b/ext/exif/tests/bug75785/bug75785.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
+$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);
+
+echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
+echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+38/1
+122/1
+===DONE===