diff options
author | Nawarian <nickolas@phpsp.org.br> | 2020-07-12 21:53:52 +0200 |
---|---|---|
committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-11 16:26:34 +0200 |
commit | 2fa4ca95db262267aa6bd46c5e2f74aa42542fc3 (patch) | |
tree | dfb0f31eee8ef2184ee8449866ec28ec41160a73 | |
parent | dc108feab8d88f62d7fcba3d2c9a058432463118 (diff) | |
download | php-git-2fa4ca95db262267aa6bd46c5e2f74aa42542fc3.tar.gz |
Fix bug #75785 by attempt switching endianness on Maker's Note
Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big refactor and a gigantic lookup
table, this commit simply attempts to switch the
endianness and proceed when values are acceptable.
Closes GH-5849.
-rw-r--r-- | NEWS | 4 | ||||
-rw-r--r-- | ext/exif/exif.c | 28 | ||||
-rw-r--r-- | ext/exif/tests/bug75785/P1000506.JPG | bin | 0 -> 35516 bytes | |||
-rw-r--r-- | ext/exif/tests/bug75785/bug75785.phpt | 17 |
4 files changed, 39 insertions, 10 deletions
@@ -16,6 +16,10 @@ PHP NEWS . Fixed bug #48585 (com_load_typelib holds reference, fails on second call). (cmb) +- Exif: + . Fixed bug #75785 (Many errors from exif_read_data). + (NÃckolas Daniel da Silva) + - Gettext: . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()). (Florian Engelhardt) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 4cb36c534b..5e4c23f4e6 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -66,7 +66,7 @@ typedef unsigned char uchar; #define EFREE_IF(ptr) if (ptr) efree(ptr) -#define MAX_IFD_NESTING_LEVEL 150 +#define MAX_IFD_NESTING_LEVEL 200 /* {{{ arginfo */ ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0) @@ -3173,6 +3173,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel); + /* It can be that motorola_intel is wrongly mapped, let's try inverting it */ + if ((2+NumDirEntries*12) > value_len) { + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure."); + + ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0; + NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel); + } + + if ((2+NumDirEntries*12) > value_len) { + exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len); + return FALSE; + } + if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) { + exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len); + return FALSE; + } + switch (maker_note->offset_mode) { case MN_OFFSET_MAKER: offset_base = value_ptr; @@ -3203,15 +3220,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu break; } - if ((2+NumDirEntries*12) > value_len) { - exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len); - return FALSE; - } - if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) { - exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len); - return FALSE; - } - for (de=0;de<NumDirEntries;de++) { size_t offset = 2 + 12 * de; if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset, diff --git a/ext/exif/tests/bug75785/P1000506.JPG b/ext/exif/tests/bug75785/P1000506.JPG Binary files differnew file mode 100644 index 0000000000..3c74b4eee3 --- /dev/null +++ b/ext/exif/tests/bug75785/P1000506.JPG diff --git a/ext/exif/tests/bug75785/bug75785.phpt b/ext/exif/tests/bug75785/bug75785.phpt new file mode 100644 index 0000000000..b9f6551185 --- /dev/null +++ b/ext/exif/tests/bug75785/bug75785.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php +$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG'; +$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false); + +echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL; +echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL; +?> +===DONE=== +--EXPECTF-- +38/1 +122/1 +===DONE=== |