MFH: fix #40109 (iptcembed fails on non-jfif jpegs)

diff --git a/NEWS b/NEWS
index 30df68de7f5c032840666241c188a6aaf99856db..9530c3f9ab98ecd4759b08e8cf599b9460ef41a0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PHP                                                                        NEWS
   methods). (Tony)
 - Fixed bug #40428 (imagepstext() doesn't accept optional parameter). (Pierre)
 - Fixed bug #40410 (ext/posix does not compile on MacOS 10.3.9). (Tony)
+- Fixed bug #40109 (iptcembed fails on non-jfif jpegs). (Tony)
 - Fixed bug #39836 (SplObjectStorage empty after unserialize). (Marcus)
 
 08 Feb 2007, PHP 5.2.1

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 3b80a17b19b2f4cae53f63df0cba1db9c98184d9..81844e7067fe3eb74d00964e9d4b9453c0f18fcb 100644 (file)
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -183,6 +183,7 @@ PHP_FUNCTION(iptcembed)
        unsigned int spool = 0, done = 0, inx, len;     
        unsigned char *spoolbuf=0, *poi=0;
        struct stat sb;
+       zend_bool written = 0;
 
     switch(ZEND_NUM_ARGS()){
     case 3:
@@ -226,7 +227,8 @@ PHP_FUNCTION(iptcembed)
        if (spool < 2) {
                fstat(fileno(fp), &sb);
 
-               poi = spoolbuf = emalloc(len + sizeof(psheader) + sb.st_size + 1024);
+               poi = spoolbuf = safe_emalloc(1, len + sizeof(psheader) + sb.st_size + 1024, 1);
+               memset(poi, 0, len + sizeof(psheader) + sb.st_size + 1024 + 1);
        } 
 
        if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xFF) {
@@ -264,6 +266,13 @@ PHP_FUNCTION(iptcembed)
 
                        case M_APP0:
                                /* APP0 is in each and every JPEG, so when we hit APP0 we insert our new APP13! */
+                       case M_APP1:
+                               if (written) {
+                                       /* don't try to write the data twice */
+                                       break;
+                               }
+                               written = 1;
+
                                php_iptc_skip_variable(fp, spool, poi?&poi:0 TSRMLS_CC);
 
                                if (len & 1) len++; /* make the length even */