From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 1 Jun 2005 22:29:20 +0000 (+0000)
Subject: MFH:  Fixed bug #33210 (relax jpeg recursive loop protection).
X-Git-Tag: php-4.4.0RC1~34
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a02c9cf4f15240ed274f80e385265c3d23143483;p=php

MFH:  Fixed bug #33210 (relax jpeg recursive loop protection).
---

diff --git a/NEWS b/NEWS
index 9122b8307a..e643084f01 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP 4                                                                      NEWS
   them sort based on the current locale. (Derick)
 - Changed sha1_file() and md5_file() functions to use streams instead of 
   low level IO. (Uwe)
+- Fixed bug #33210 (relax jpeg recursive loop protection). (Ilia)
 - Fixed bug #33200 (preg_replace(): magic_quotes_sybase=On makes 'e' modifier
   misbehave). (Jani)
 - Fixed bug #33072 (Add a safemode/open_basedir check for runtime save_path 
diff --git a/ext/standard/image.c b/ext/standard/image.c
index 6a015cb326..4849fff715 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -401,7 +401,7 @@ static unsigned int php_next_marker(php_stream * stream, int last_marker, int co
 				last_marker = M_PSEUDO; /* stop skipping non 0xff for M_COM */
 			}
 		}
-		if (++a > 10)
+		if (++a > 25)
 		{
 			/* who knows the maxim amount of 0xff? though 7 */
 			/* but found other implementations              */