From: Kalle Sommer Nielsen <kalle@php.net>
Date: Wed, 3 Aug 2016 03:39:39 +0000 (+0200)
Subject: Fixed bug #72735 (Samsung picture thumb not read (zero size))
X-Git-Tag: php-7.2.0alpha1~1558^2~70
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=406dff2a02ff1cfac89942ce5e991d88d3b6cb50;p=php

Fixed bug #72735 (Samsung picture thumb not read (zero size))

This fix is only committed to master for now. I'm no exif expert on this matter, so someone else might want to take a look over this and merge as wanted in case this will break something.

In exif_process_IFD_in_JPEG() we loop over the tag entries and try to process the IFD tag, this is fine and all, however in case one fail to process correctly, the entire routine is aborted, which means that other possible data, such as the thumbnail data as reported in #72735 may not be read, despite it is there, perfectly valid.

Also, big props to whoever added EXIF_DEBUG, this rocks!
---

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 9f951d78a3..9e4c14a82d 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -3152,7 +3152,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
 								  offset_base, IFDlength, displacement, section_index, 1, exif_get_tag_table(section_index))) {
-			return FALSE;
+			continue;
 		}
 	}
 	/*
@@ -3430,7 +3430,6 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 				if ((itemlen - 2) < 6) {
 					return FALSE;
 				}
-
 				exif_process_SOFn(Data, marker, &sof_info);
 				ImageInfo->Width  = sof_info.width;
 				ImageInfo->Height = sof_info.height;
diff --git a/ext/exif/tests/bug72735/bug72735.phpt b/ext/exif/tests/bug72735/bug72735.phpt
new file mode 100644
index 0000000000..4a8d360ff0
--- /dev/null
+++ b/ext/exif/tests/bug72735/bug72735.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #72735 (Samsung picture thumb not read (zero size))
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+foreach (['nokia.jpg', 'samsung.jpg'] as $picture) {
+	$len = strlen(exif_thumbnail(__DIR__ . '/' . $picture));
+
+	if ($len === 0) {
+		echo $picture . ': error, no thumbnail length', PHP_EOL;
+
+		continue;
+	}
+
+	echo $picture . ': int(' . $len . ')', PHP_EOL;
+}
+?>
+--EXPECTF--
+nokia.jpg: int(%d)
+samsung.jpg: int(%d)
diff --git a/ext/exif/tests/bug72735/nokia.jpg b/ext/exif/tests/bug72735/nokia.jpg
new file mode 100644
index 0000000000..48367bfb84
Binary files /dev/null and b/ext/exif/tests/bug72735/nokia.jpg differ
diff --git a/ext/exif/tests/bug72735/samsung.jpg b/ext/exif/tests/bug72735/samsung.jpg
new file mode 100644
index 0000000000..70096066a8
Binary files /dev/null and b/ext/exif/tests/bug72735/samsung.jpg differ