PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2005, PHP 5.0.4
+- Fixed bug #28451 (corupt EXIF headers have unlimited recursive IFD directory
+ entries). (Andrei)
- Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
- Added length and charsetnr for field array and object in mysqli. (Georg)
- Changed phpize not to require automake and libtool. (Jani)
#define EFREE_IF(ptr) if (ptr) efree(ptr)
+#define MAX_IFD_NESTING_LEVEL 5
+
static
ZEND_BEGIN_ARG_INFO(exif_thumbnail_force_ref, 1)
ZEND_ARG_PASS_INFO(0)
ZEND_END_ARG_INFO();
-
/* {{{ exif_functions[]
*/
function_entry exif_functions[] = {
/* for parsing */
int read_thumbnail;
int read_all;
+ int ifd_nesting_level;
/* internal */
file_section_list file;
} image_info_type;
size_t byte_count, offset_val, fpos, fgot;
xp_field_type *tmp_xp;
+ /* Protect against corrupt headers */
+ if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+ exif_error_docref("exif_read_data#error_ifd" TSRMLS_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
+ return FALSE;
+ }
+ ImageInfo->ifd_nesting_level++;
+
tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
}
}
+ ImageInfo->ifd_nesting_level = 0;
+
/* Scan the JPEG headers. */
ret = exif_scan_FILE_header(ImageInfo TSRMLS_CC);