From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 4 Nov 2003 01:38:33 +0000 (+0000)
Subject: MFH: Fixed bug #25581 (getimagesize () return incorrect values on bitmap
X-Git-Tag: php-4.3.5RC1~248
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ed5212ca705f3bfab7cac3cca0cb8ad4d2af68f9;p=php

MFH: Fixed bug #25581 (getimagesize () return incorrect values on bitmap
(os2) files).
---

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 2a8aa06de7..6c2a102830 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -143,18 +143,29 @@ static struct gfxinfo *php_handle_psd (php_stream * stream TSRMLS_DC)
 static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
 {
 	struct gfxinfo *result = NULL;
-	unsigned char dim[12];
+	unsigned char dim[16];
+	int size;
 
-	if (php_stream_seek(stream, 15, SEEK_CUR))
+	if (php_stream_seek(stream, 11, SEEK_CUR))
 		return NULL;
 
 	if (php_stream_read(stream, dim, sizeof(dim)) != sizeof(dim))
 		return NULL;
 
-	result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
-	result->width    =  (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
-	result->height   =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
-	result->bits     =  (((unsigned int)dim[11]) <<  8) +  ((unsigned int)dim[10]);
+	size   = (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
+	if (size == 12) {
+		result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+		result->width    =  (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+		result->height   =  (((unsigned int)dim[ 7]) << 8) + ((unsigned int) dim[ 6]);
+		result->bits     =  ((unsigned int)dim[11]);
+	} else if (size > 12 && (size <= 64 || size == 108)) {
+		result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+		result->width    =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+		result->height   =  (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+		result->bits     =  (((unsigned int)dim[15]) <<  8) +  ((unsigned int)dim[14]);
+	} else {
+		return NULL;
+	}
 
 	return result;
 }