- Slightly redesign

# More to follow, explanation follows at more public place

diff --git a/ext/standard/image.c b/ext/standard/image.c
index e37175d6e18b90631b19051af6c1c21e4a9cba17..2fd361474db6e0bc45255905a423863b0569dc2b 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -866,38 +866,41 @@ static struct gfxinfo *php_handle_iff(php_stream * stream TSRMLS_DC)
        int chunkId;
        int size;
 
-       if (php_stream_read(stream, a, 8) != 8)
+       if (php_stream_read(stream, a, 8) != 8) {
                return NULL;
-       if (strncmp(a+4, "ILBM", 4) && strncmp(a+4, "PBM ", 4))
+       }
+       if (strncmp(a+4, "ILBM", 4) && strncmp(a+4, "PBM ", 4)) {
                return NULL;
-
-       result = (struct gfxinfo *) ecalloc(1, sizeof(struct gfxinfo));
+       }
 
        /* loop chunks to find BMHD chunk */
        do {
                if (php_stream_read(stream, a, 8) != 8) {
-                       efree(result);
                        return NULL;
                }
                chunkId = php_ifd_get32s(a+0, 1);
                size    = php_ifd_get32s(a+4, 1);
+               if (size < 0) {
+                       return NULL;
+               }
                if ((size & 1) == 1) {
                        size++;
                }
                if (chunkId == 0x424d4844) { /* BMHD chunk */
                        if (php_stream_read(stream, a, 9) != 9) {
-                               efree(result);
                                return NULL;
                        }
+                       result = (struct gfxinfo *) ecalloc(1, sizeof(struct gfxinfo));
                        result->width    = php_ifd_get16s(a+0, 1);
                        result->height   = php_ifd_get16s(a+2, 1);
                        result->bits     = a[8] & 0xff;
                        result->channels = 0;
-                       if (result->width > 0 && result->height > 0 && result->bits > 0 && result->bits < 33)
+                       if (result->width > 0 && result->height > 0 && result->bits > 0 && result->bits < 33) {
                                return result;
+                       }
+                       efree(result);
                } else {
                        if (php_stream_seek(stream, size, SEEK_CUR)) {
-                               efree(result);
                                return NULL;
                        }
                }