diff options
| author | Felipe Pena <felipensp@gmail.com> | 2012-04-29 19:14:03 -0300 |
|---|---|---|
| committer | Felipe Pena <felipensp@gmail.com> | 2012-04-29 19:14:03 -0300 |
| commit | 6008f9af8fa6beab92a4c96d11d641c95f97162c (patch) | |
| tree | 2a01f3f671bc0040e065b865c01b1a223c0bc987 | |
| parent | 6f8fae606bcbf37cea4d6e03a065a705924b08bf (diff) | |
| parent | d44a3839861113dee10c7041d589096b82f23cc5 (diff) | |
| download | php-git-6008f9af8fa6beab92a4c96d11d641c95f97162c.tar.gz | |
Merge branch 'PHP-5.3' into PHP-5.4
* PHP-5.3:
- Added missing bound check in iptcparse() (path by chris at chiappa.net)
| -rw-r--r-- | ext/standard/iptc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index bf01e74bac..43dc372bcf 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -336,13 +336,13 @@ PHP_FUNCTION(iptcparse) len = (((unsigned short) buffer[ inx ])<<8) | (unsigned short)buffer[ inx+1 ]; inx += 2; } - - snprintf(key, sizeof(key), "%d#%03d", (unsigned int) dataset, (unsigned int) recnum); - - if ((len > str_len) || (inx + len) > str_len) { + + if ((len < 0) || (len > str_len) || (inx + len) > str_len) { break; } + snprintf(key, sizeof(key), "%d#%03d", (unsigned int) dataset, (unsigned int) recnum); + if (tagsfound == 0) { /* found the 1st tag - initialize the return array */ array_init(return_value); } |