diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2008-03-12 17:33:14 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2008-03-12 17:33:14 +0000 |
| commit | 0f1e56bc3a1e1bf4a43779fabaf7201ff1162050 (patch) | |
| tree | bc9b9e9d3b94fed1518be63e0f3d65db12e9d4c8 | |
| parent | f2c14fd8b0085673dda152b43973e0435d14c2a4 (diff) | |
| download | php-git-0f1e56bc3a1e1bf4a43779fabaf7201ff1162050.tar.gz | |
MFB: Fixed bug #44388 (Crash inside exif_read_data() on invalid images)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/exif/exif.c | 2 |
2 files changed, 2 insertions, 1 deletions
@@ -2,6 +2,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Mar 2008 , PHP 5.2.6 - Fixed bug #44394 (Last two bytes missing from output). (Felipe) +- Fixed bug #44388 (Crash inside exif_read_data() on invalid images) (Ilia) - Fixed bug #44373 (PDO_OCI extension compile failed). (Felipe) 06 Mar 2008, PHP 5.2.6RC2 diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 5aa0ab2e1c..b2d9811a94 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2877,7 +2877,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha /* exception are IFD pointers */ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X + x%04X = x%04X > x%04X)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val, byte_count, offset_val+byte_count, IFDlength); } - return TRUE; + return FALSE; } if (byte_count>sizeof(cbuf)) { /* mark as outside range and get buffer */ |