php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 16:22:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

#48378, exif_read_data() segfaults on certain corrupted .jpeg files

Browse Source
This commit is contained in:
Pierre Joye
2009-05-28 13:44:43 +00:00
parent df4d44d78c
commit c85b4de5fb
3 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/exif/exif.c
View File

@@ -3188,6 +3188,10 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
return;
}
if (offset_of_ifd > length) {
exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start");
return;
}
ImageInfo->sections_found |= FOUND_IFD0;
/* First directory starts at offset 8. Offsets starts at 0. */

BIN
ext/exif/tests/bug48378.jpeg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.5 KiB

19
ext/exif/tests/bug48378.phpt Normal file
View File

@@ -0,0 +1,19 @@
--TEST--
Bug #48378 (Infinite recursion due to corrupt JPEG)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
exif_read_data(
dirname(__FILE__) . "/bug48378.jpeg",
"FILE,COMPUTED,ANY_TAG"
);
?>
--EXPECTF--
Warning: exif_read_data(%s): Invalid IFD start in %s48378.php on line %d
Warning: exif_read_data(%s): Error reading from file: got=x08B4(=2228) != itemlen-2=x1FFE(=8190) in %s48378.php on line %d
Warning: exif_read_data(%s): Invalid JPEG file in %s48378.php on line %d