From c69b76dc521590796c274ae43ed986942a216949 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Thu, 10 May 2007 12:23:25 +0000
Subject: [PATCH] MFH: fix segfault in iptcembed()

---
 ext/standard/iptc.c                         |  8 ++++----
 ext/standard/tests/image/iptcembed_001.phpt | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)
 create mode 100644 ext/standard/tests/image/iptcembed_001.phpt

diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
index 921fcdd8b6..f31861635e 100644
--- a/ext/standard/iptc.c
+++ b/ext/standard/iptc.c
@@ -212,16 +212,16 @@ PHP_FUNCTION(iptcembed)
 
 	if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xFF) {
 		fclose(fp);
-		if (poi) {
-			efree(poi);
+		if (spoolbuf) {
+			efree(spoolbuf);
 		}
 		RETURN_FALSE;
 	}
 
 	if (php_iptc_get1(fp, spool, poi?&poi:0 TSRMLS_CC) != 0xD8) {
 		fclose(fp);
-		if (poi) {
-			efree(poi);
+		if (spoolbuf) {
+			efree(spoolbuf);
 		}
 		RETURN_FALSE;
 	}
diff --git a/ext/standard/tests/image/iptcembed_001.phpt b/ext/standard/tests/image/iptcembed_001.phpt
new file mode 100644
index 0000000000..feadddea1b
--- /dev/null
+++ b/ext/standard/tests/image/iptcembed_001.phpt
@@ -0,0 +1,18 @@
+--TEST--
+iptcembed() and wrong file
+--FILE--
+<?php
+
+$file = dirname(__FILE__).'/iptcembed_001.data';
+$fp = fopen($file, "w");
+fwrite($fp, "-1-1");
+fclose($fp);
+
+var_dump(iptcembed(-1, $file, -1));
+unlink($file);
+
+echo "Done\n";
+?>
+--EXPECTF--
+bool(false)
+Done	
-- 
2.40.0