From 381734bede2d5c2392e39d8e6ead6bb13d52a8c7 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 1 Jun 2005 22:28:38 +0000 Subject: [PATCH] MFH: Fixed bug #33210 (relax jpeg recursive loop protection). --- NEWS | 1 + ext/standard/image.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 781d72c42a..2f2667a638 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,7 @@ PHP NEWS - Fixed ext/mysqli to allocate less memory when fetching bound params of type (MEDIUM|LONG)BLOB/(MEDIUM|LONG)TEXT. (Andrey) - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey) +- Fixed bug #33210 (relax jpeg recursive loop protection). (Ilia) - Fixed bug #33200 (preg_replace(): magic_quotes_sybase=On makes 'e' modifier misbehave). (Jani) - Fixed bug #33185 (--enable-session=shared does not build). (Jani) diff --git a/ext/standard/image.c b/ext/standard/image.c index 1c9e7b7ecc..0b40643d74 100644 --- a/ext/standard/image.c +++ b/ext/standard/image.c @@ -401,7 +401,7 @@ static unsigned int php_next_marker(php_stream * stream, int last_marker, int co last_marker = M_PSEUDO; /* stop skipping non 0xff for M_COM */ } } - if (++a > 10) + if (++a > 25) { /* who knows the maxim amount of 0xff? though 7 */ /* but found other implementations */ -- 2.50.1