projects / packages / php.git / blame
| Commit | Line | Data |
|---|---|---|
| fb98beff ER |
1 | --- PHP_5_3/ext/exif/exif.c 2011/02/14 08:46:53 308315 |
| 2 | +++ PHP_5_3/ext/exif/exif.c 2011/02/14 09:08:44 308316 | |
| 3 | @@ -40,6 +40,10 @@ | |
| 4 | #include "php.h" | |
| 5 | #include "ext/standard/file.h" | |
| 6 | ||
| 7 | +#ifdef PHP_WIN32 | |
| 8 | +include "win32/php_stdint.h" | |
| 9 | +#endif | |
| 10 | + | |
| 11 | #if HAVE_EXIF | |
| 12 | ||
| 13 | /* When EXIF_DEBUG is defined the module generates a lot of debug messages | |
| 14 | @@ -2821,6 +2825,7 @@ | |
| 15 | int tag, format, components; | |
| 16 | char *value_ptr, tagname[64], cbuf[32], *outside=NULL; | |
| 17 | size_t byte_count, offset_val, fpos, fgot; | |
| 18 | + int64_t byte_count_signed; | |
| 19 | xp_field_type *tmp_xp; | |
| 20 | #ifdef EXIF_DEBUG | |
| 21 | char *dump_data; | |
| 22 | @@ -2845,13 +2850,20 @@ | |
| 23 | /*return TRUE;*/ | |
| 24 | } | |
| 25 | ||
| 26 | - byte_count = components * php_tiff_bytes_per_format[format]; | |
| 27 | + if (components < 0) { | |
| 28 | + exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), byte_count); | |
| 29 | + return FALSE; | |
| 30 | + } | |
| 31 | + | |
| 32 | + byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format]; | |
| 33 | ||
| 34 | - if ((ssize_t)byte_count < 0) { | |
| 35 | + if (byte_count_signed < 0 || (byte_count_signed > 2147483648)) { | |
| 36 | exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), byte_count); | |
| 37 | return FALSE; | |
| 38 | } | |
| 39 | ||
| 40 | + byte_count = (size_t)byte_count_signed; | |
| 41 | + | |
| 42 | if (byte_count > 4) { | |
| 43 | offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel); | |
| 44 | /* If its bigger than 4 bytes, the dir entry contains an offset. */ | |
| 45 | @@ -2916,6 +2928,7 @@ | |
| 46 | efree(dump_data); | |
| 47 | } | |
| 48 | #endif | |
| 49 | + | |
| 50 | if (section_index==SECTION_THUMBNAIL) { | |
| 51 | if (!ImageInfo->Thumbnail.data) { | |
| 52 | switch(tag) { |