MFH: Fixed bug #29443 (Sanity check for wbmp detection).

diff --git a/ext/standard/image.c b/ext/standard/image.c
index c2c3c7ab8626ed95a9075be3a0144fea68e4a892..329cd92bd6d9c878510142b33fbc4e1c2491042a 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -955,6 +955,11 @@ static int php_get_wbmp(php_stream *stream, struct gfxinfo **result, int check T
                }
                height = (height << 7) | (i & 0x7f);
        } while (i & 0x80);
+
+       /* maximum valid sizes for wbmp (although 127x127 may be a more accurate one) */
+       if (height > 2048 || width > 2048) {
+               return 0;
+       }
        
        if (!check) {
                (*result)->width = width;