Fix bug #68113 (Heap corruption in exif_thumbnail())

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 42f8a2410217ed6e9265fab1ff70610089135ca5..06e1dae41ae678068272db10cb6092dce68fd27c 100644 (file)
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2413,11 +2413,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
                                        data_ptr += 8;
                                        break;
                                case TAG_FMT_SINGLE:
-                                       memmove(data_ptr, &info_data->value.f, byte_count);
+                                       memmove(data_ptr, &info_value->f, 4);
                                        data_ptr += 4;
                                        break;
                                case TAG_FMT_DOUBLE:
-                                       memmove(data_ptr, &info_data->value.d, byte_count);
+                                       memmove(data_ptr, &info_value->d, 8);
                                        data_ptr += 8;
                                        break;
                        }

diff --git a/ext/exif/tests/bug68113.jpg b/ext/exif/tests/bug68113.jpg
new file mode 100755 (executable)
index 0000000..3ce7a62
Binary files /dev/null and b/ext/exif/tests/bug68113.jpg differ

diff --git a/ext/exif/tests/bug68113.phpt b/ext/exif/tests/bug68113.phpt
new file mode 100644 (file)
index 0000000..0fa4c4a
--- /dev/null
+++ b/ext/exif/tests/bug68113.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
\ No newline at end of file