@- Fixed buffer overruns in iptcembed(). (Thies)

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 88922be658ccc1336f51adadef8721239e393416..cd6d107f4f42381854839a4f53ecaa4ef59a54c5 100644 (file)
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -218,7 +218,7 @@ PHP_FUNCTION(iptcembed)
        if (spool < 2) {
                fstat(fileno(fp),&sb);
 
-               poi = spoolbuf = emalloc(len + 30 + sb.st_size);
+               poi = spoolbuf = emalloc(len + sizeof(psheader) + sb.st_size + 1024);
 
                if (! spoolbuf) {
                        fclose(fp);