fix segfault in iptcembed()

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 6045803d466655381eec8ef72c73eb77d38c32e8..1a41c73918f3b2b3715ef249899f908d1dc196f4 100644 (file)
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -211,16 +211,16 @@ PHP_FUNCTION(iptcembed)
 
        if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xFF) {
                fclose(fp);
-               if (poi) {
-                       efree(poi);
+               if (spoolbuf) {
+                       efree(spoolbuf);
                }
                RETURN_FALSE;
        }
 
        if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xD8) {
                fclose(fp);
-               if (poi) {
-                       efree(poi);
+               if (spoolbuf) {
+                       efree(spoolbuf);
                }
                RETURN_FALSE;
        }

diff --git a/ext/standard/tests/image/iptcembed_001.phpt b/ext/standard/tests/image/iptcembed_001.phpt
new file mode 100644 (file)
index 0000000..4a4c6b3
--- /dev/null
+++ b/ext/standard/tests/image/iptcembed_001.phpt
@@ -0,0 +1,17 @@
+--TEST--
+iptcembed() and wrong file
+--FILE--
+<?php
+
+$file = dirname(__FILE__).'/iptcembed_001.data';
+$fp = fopen($file, "w");
+fwrite($fp, b"-1-1");
+fclose($fp);
+
+var_dump(iptcembed(-1, $file, -1));
+
+echo "Done\n";
+?>
+--EXPECTF--
+bool(false)
+Done