diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-12-31 19:31:49 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-12-31 19:31:49 -0800 |
| commit | 1cda0d7c2ffb62d8331c64e703131d9cabdc03ea (patch) | |
| tree | e2f8acb4a7bbaaeee18577eca4af8abeb14cc646 | |
| parent | e5246580a85f031e1a3b8064edbaa55c1643a451 (diff) | |
| download | php-git-1cda0d7c2ffb62d8331c64e703131d9cabdc03ea.tar.gz | |
Fix bug #73737 FPE when parsing a tag format
| -rw-r--r-- | ext/exif/exif.c | 2 | ||||
| -rw-r--r-- | ext/exif/tests/bug73737.phpt | 12 | ||||
| -rw-r--r-- | ext/exif/tests/bug73737.tiff | bin | 0 -> 48 bytes |
3 files changed, 13 insertions, 1 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 8b0e34c10d..83daee6f54 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte if (s_den == 0) { return 0; } else { - return php_ifd_get32s(value, motorola_intel) / s_den; + return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den); } case TAG_FMT_SSHORT: return php_ifd_get16u(value, motorola_intel); diff --git a/ext/exif/tests/bug73737.phpt b/ext/exif/tests/bug73737.phpt new file mode 100644 index 0000000000..21eaf80585 --- /dev/null +++ b/ext/exif/tests/bug73737.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #73737 (Crash when parsing a tag format) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php + $exif = exif_thumbnail(__DIR__ . '/bug73737.tiff'); + var_dump($exif); +?> +--EXPECTF-- +Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d +bool(false) diff --git a/ext/exif/tests/bug73737.tiff b/ext/exif/tests/bug73737.tiff Binary files differnew file mode 100644 index 0000000000..2cb036fc47 --- /dev/null +++ b/ext/exif/tests/bug73737.tiff |