From: Antony Dovgal <tony2001@php.net>
Date: Thu, 10 May 2007 12:21:42 +0000 (+0000)
Subject: fix segfault in iptcembed()
X-Git-Tag: RELEASE_1_2_0~120
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=806ebfb3f559b8d4798680453c66e627064f91bc;p=php

fix segfault in iptcembed()
---

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 6045803d46..1a41c73918 100644
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -211,16 +211,16 @@ PHP_FUNCTION(iptcembed)
 
 	if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xFF) {
 		fclose(fp);
-		if (poi) {
-			efree(poi);
+		if (spoolbuf) {
+			efree(spoolbuf);
 		}
 		RETURN_FALSE;
 	}
 
 	if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xD8) {
 		fclose(fp);
-		if (poi) {
-			efree(poi);
+		if (spoolbuf) {
+			efree(spoolbuf);
 		}
 		RETURN_FALSE;
 	}
diff --git a/ext/standard/tests/image/iptcembed_001.phpt b/ext/standard/tests/image/iptcembed_001.phpt
new file mode 100644
index 0000000000..4a4c6b3123
--- /dev/null
+++ b/ext/standard/tests/image/iptcembed_001.phpt
@@ -0,0 +1,17 @@
+--TEST--
+iptcembed() and wrong file
+--FILE--
+<?php
+
+$file = dirname(__FILE__).'/iptcembed_001.data';
+$fp = fopen($file, "w");
+fwrite($fp, b"-1-1");
+fclose($fp);
+
+var_dump(iptcembed(-1, $file, -1));
+
+echo "Done\n";
+?>
+--EXPECTF--
+bool(false)
+Done