@ - Fixed crash in iptcparse() if the supplied data was bogus. (Thies)

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 0d07354455a8857346c3a8aacff533cfa048b892..8fb51fb9a3ff7151877c98c831fe1231310190da 100644 (file)
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -351,7 +351,7 @@ PHP_FUNCTION(iptcparse)
 
                sprintf(key,"%d#%03d",(unsigned int) dataset,(unsigned int) recnum);
 
-               if ((inx + len) > length)
+               if ((len > length) || (inx + len) > length)
                        break;
 
                if (tagsfound == 0) { /* found the 1st tag - initialize the return array */