Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with correct...

diff --git a/NEWS b/NEWS
index 8a05976893c4c9a0a84ebdce489fe4a1a4b1f91b..a088bd73826dc95da7f0e0553785721c19fb16cd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ PHP                                                                        NEWS
     unserialize). (Nikita)
   . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
     php_parse_date()). (Derick)
+       
+- EXIF:
+  . Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with 
+    correct exif format). (bradpiccho at gmail dot com, Kalle)
 
 - GD:
   . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index ab920223405b475cd4738e7c99bf406eb54fbf20..a75c0ba0f1b209700482d7c72a40c9a0abd4cc63 100644 (file)
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -3553,7 +3553,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 
        ImageInfo->sections_found |= FOUND_IFD0;
 
-       if ((dir_start + 2) >= (offset_base+IFDlength)) {
+       if ((dir_start + 2) > (offset_base+IFDlength)) {
                exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
                return FALSE;
        }
@@ -3581,7 +3581,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
         * Hack to make it process IDF1 I hope
         * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
         */
-       if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
+       if ((dir_start+2+12*de + 4) > (offset_base+IFDlength)) {
                exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
                return FALSE;
        }

diff --git a/ext/exif/tests/bug74428/bug74428.jpg b/ext/exif/tests/bug74428/bug74428.jpg
new file mode 100644 (file)
index 0000000..73c7805
Binary files /dev/null and b/ext/exif/tests/bug74428/bug74428.jpg differ

diff --git a/ext/exif/tests/bug74428/bug74428.phpt b/ext/exif/tests/bug74428/bug74428.phpt
new file mode 100644 (file)
index 0000000..b2beca3
--- /dev/null
+++ b/ext/exif/tests/bug74428/bug74428.phpt
@@ -0,0 +1,50 @@
+--TEST--
+Bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with correct exif format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--INI--
+output_handler=
+zlib.output_compression=0 
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/bug74428.jpg';
+var_dump(exif_read_data($infile));
+?>
+===DONE===
+--EXPECTF--
+array(11) {
+  ["FileName"]=>
+  string(12) "bug74428.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(1902)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(19) "ANY_TAG, IFD0, EXIF"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(22) "width="88" height="28""
+    ["Height"]=>
+    int(28)
+    ["Width"]=>
+    int(88)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["Orientation"]=>
+  int(1)
+  ["Exif_IFD_Pointer"]=>
+  int(38)
+  ["ExifImageWidth"]=>
+  int(88)
+  ["ExifImageLength"]=>
+  int(28)
+}
+===DONE===