MFH Bug #30627

diff --git a/NEWS b/NEWS
index 944bf948348956222b3c2272db9547bf6193c32a..86c688aa299893c869d9d79fc783d64588961aaa 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP 4                                                                      NEWS
 - Fixed a bug in addslashes() handling of the '\0' character. (Ilia)
 - Backported Marcus' foreach() speedup patch from PHP 5.x. (Derick)
 - Fixed potential problems with unserializing invalid serialize data. (Marcus)
+- Fixed bug #30672 (Problem handling exif data in jpeg images at unusual 
+  places). (Marcus)
 - Fixed bug #30658 (Ensure that temporary files created by GD are removed).
   (Ilia)
 - Fixed bug #30654 (oci8 persistent connection is deleted from hash 

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 759c285912c6c0a1d6a149f4680b9f86d53752a8..05bc1cb90d03fc21ba7951b30711c53b23fc3012 100644 (file)
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2712,7 +2712,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
                        // JPEG does not use absolute pointers instead its pointers are relative to the start
                        // of the TIFF header in APP1 section.
                        */
-                       if (offset_val+byte_count>ImageInfo->FileSize || (ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_II && ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_MM)) {
+                       if (offset_val+byte_count>ImageInfo->FileSize || (ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_II && ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_MM && ImageInfo->FileType!=IMAGE_FILETYPE_JPEG)) {
                                if (value_ptr < dir_entry) {
                                        /* we can read this if offset_val > 0 */
                                        /* some files have their values in other parts of the file */