MFH: Fixed bug #25581 (getimagesize () return incorrect values on bitmap

(os2) files).

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 2a8aa06de77ee5a6665ab72d0072fdad341f6650..6c2a10283047a64bede3d2327877e2dcab2d3a76 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -143,18 +143,29 @@ static struct gfxinfo *php_handle_psd (php_stream * stream TSRMLS_DC)
 static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
 {
        struct gfxinfo *result = NULL;
-       unsigned char dim[12];
+       unsigned char dim[16];
+       int size;
 
-       if (php_stream_seek(stream, 15, SEEK_CUR))
+       if (php_stream_seek(stream, 11, SEEK_CUR))
                return NULL;
 
        if (php_stream_read(stream, dim, sizeof(dim)) != sizeof(dim))
                return NULL;
 
-       result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
-       result->width    =  (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
-       result->height   =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
-       result->bits     =  (((unsigned int)dim[11]) <<  8) +  ((unsigned int)dim[10]);
+       size   = (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
+       if (size == 12) {
+               result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+               result->width    =  (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+               result->height   =  (((unsigned int)dim[ 7]) << 8) + ((unsigned int) dim[ 6]);
+               result->bits     =  ((unsigned int)dim[11]);
+       } else if (size > 12 && (size <= 64 || size == 108)) {
+               result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+               result->width    =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+               result->height   =  (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+               result->bits     =  (((unsigned int)dim[15]) <<  8) +  ((unsigned int)dim[14]);
+       } else {
+               return NULL;
+       }
 
        return result;
 }