diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 085dc9fa662..7aca5895301 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3188,6 +3188,10 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf, exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)"); return; } + if (offset_of_ifd > length) { + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start"); + return; + } ImageInfo->sections_found |= FOUND_IFD0; /* First directory starts at offset 8. Offsets starts at 0. */ diff --git a/ext/exif/tests/bug48378.jpeg b/ext/exif/tests/bug48378.jpeg new file mode 100644 index 00000000000..759d8057098 Binary files /dev/null and b/ext/exif/tests/bug48378.jpeg differ diff --git a/ext/exif/tests/bug48378.phpt b/ext/exif/tests/bug48378.phpt new file mode 100644 index 00000000000..286ce610733 --- /dev/null +++ b/ext/exif/tests/bug48378.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #48378 (Infinite recursion due to corrupt JPEG) +--SKIPIF-- + +--FILE-- + +--EXPECTF-- +Warning: exif_read_data(%s): Invalid IFD start in %s48378.php on line %d + +Warning: exif_read_data(%s): Error reading from file: got=x08B4(=2228) != itemlen-2=x1FFE(=8190) in %s48378.php on line %d + +Warning: exif_read_data(%s): Invalid JPEG file in %s48378.php on line %d + +