- MFH Fix for #40073

1 files changed, 87 insertions, 3 deletions

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 7a15485af8..d639d31abd 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -1150,6 +1150,80 @@ static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
 }
 /* }}} */
 
+#ifdef EXIF_DEBUG
+char * exif_dump_data(int *dump_free, int format, int components, int length, int motorola_intel, char *value_ptr TSRMLS_DC) /* {{{ */
+{
+	char *dump;
+	int len;
+
+	*dump_free = 0;
+	if (format == TAG_FMT_STRING) {
+		return value_ptr ? value_ptr : "<no data>";
+	}
+	if (format == TAG_FMT_UNDEFINED) {
+		return "<undefined>\n";
+	}
+	if (format == TAG_FMT_IFD) {
+		return "";
+	}
+	if (format == TAG_FMT_SINGLE || format == TAG_FMT_DOUBLE) {
+		return "<not implemented>";
+	}
+	*dump_free = 1;
+	if (components > 1) {
+		len = spprintf(&dump, 0, "(%d,%d) {", components, length);
+	} else {
+		len = spprintf(&dump, 0, "{");
+	}
+	while(components > 0) {
+		switch(format) {
+			case TAG_FMT_BYTE:
+			case TAG_FMT_UNDEFINED:
+			case TAG_FMT_STRING:
+			case TAG_FMT_SBYTE:
+				dump = erealloc(dump, len + 4);
+				sprintf(dump + len, "0x%02X", *value_ptr);
+				len += 4;
+				value_ptr++;
+				break;
+			case TAG_FMT_USHORT:
+			case TAG_FMT_SSHORT:
+				dump = erealloc(dump, len + 6);
+				sprintf(dump + len, "0x%04X", php_ifd_get16s(value_ptr, motorola_intel));
+				len += 6;
+				value_ptr += 2;
+				break;
+			case TAG_FMT_ULONG:
+			case TAG_FMT_SLONG:
+				dump = erealloc(dump, len + 6);
+				sprintf(dump + len, "0x%04X", php_ifd_get32s(value_ptr, motorola_intel));
+				len += 6;
+				value_ptr += 4;
+				break;
+			case TAG_FMT_URATIONAL:
+			case TAG_FMT_SRATIONAL:
+				dump = erealloc(dump, len + 13);
+				sprintf(dump + len, "0x%04X/0x%04X", php_ifd_get32s(value_ptr, motorola_intel), php_ifd_get32s(value_ptr+4, motorola_intel));
+				len += 13;
+				value_ptr += 8;
+				break;
+		}
+		if (components > 0) {
+			dump = erealloc(dump, len + 2);
+			sprintf(dump + len, ", ");
+			len += 2;			
+			components--;
+		} else{
+			break;
+		}
+	}
+	dump = erealloc(dump, len + 2);
+	sprintf(dump + len, "}");
+	return dump;
+}
+/* }}} */
+#endif
+
 /* {{{ exif_convert_any_format
  * Evaluate number, be it int, rational, or float from directory. */
 static double exif_convert_any_format(void *value, int format, int motorola_intel TSRMLS_DC)
@@ -2747,10 +2821,14 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
 	size_t byte_count, offset_val, fpos, fgot;
 	xp_field_type *tmp_xp;
+#ifdef EXIF_DEBUG
+	char *dump_data;
+	int dump_free;
+#endif /* EXIF_DEBUG */
 
 	/* Protect against corrupt headers */
 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-		exif_error_docref("exif_read_data#error_ifd" TSRMLS_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
 		return FALSE;
 	}
 	ImageInfo->ifd_nesting_level++;
@@ -2835,7 +2913,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 
 	ImageInfo->sections_found |= FOUND_ANY_TAG;
 #ifdef EXIF_DEBUG
-	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process tag(x%04X=%s,@x%04X + x%04X(=%d)): %s%s", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val+displacement, byte_count, byte_count, (components>1)&&format!=TAG_FMT_UNDEFINED&&format!=TAG_FMT_STRING?"ARRAY OF ":"", format==TAG_FMT_STRING?(value_ptr?value_ptr:"<no data>"):exif_get_tagformat(format));
+	dump_data = exif_dump_data(&dump_free, format, components, length, ImageInfo->motorola_intel, value_ptr TSRMLS_CC);
+	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process tag(x%04X=%s,@x%04X + x%04X(=%d)): %s%s %s", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val+displacement, byte_count, byte_count, (components>1)&&format!=TAG_FMT_UNDEFINED&&format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(format), dump_data);
+	if (dump_free) {
+		efree(dump_data);
+	}
 #endif
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
@@ -3024,7 +3106,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
 						return FALSE;
 					}
-					exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index TSRMLS_CC);
+					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index TSRMLS_CC)) {
+						return FALSE;
+					}
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(sub_section_index));
 #endif