- Fixed bug #25581 (getimagesize () return incorrect values on bitmap

  (os2) files)

1 files changed, 17 insertions, 6 deletions

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 366cfe2982..fede26f657 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -143,18 +143,29 @@ static struct gfxinfo *php_handle_psd (php_stream * stream TSRMLS_DC)
 static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
 {
 	struct gfxinfo *result = NULL;
-	unsigned char dim[12];
+	unsigned char dim[16];
+	int size;
 
-	if (php_stream_seek(stream, 15, SEEK_CUR))
+	if (php_stream_seek(stream, 11, SEEK_CUR))
 		return NULL;
 
 	if (php_stream_read(stream, dim, sizeof(dim)) != sizeof(dim))
 		return NULL;
 
-	result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
-	result->width    =  (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
-	result->height   =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
-	result->bits     =  (((unsigned int)dim[11]) <<  8) +  ((unsigned int)dim[10]);
+	size   = (((unsigned int)dim[ 3]) << 24) + (((unsigned int)dim[ 2]) << 16) + (((unsigned int)dim[ 1]) << 8) + ((unsigned int) dim[ 0]);
+	if (size == 12) {
+		result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+		result->width    =  (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+		result->height   =  (((unsigned int)dim[ 7]) << 8) + ((unsigned int) dim[ 6]);
+		result->bits     =  ((unsigned int)dim[11]);
+	} else if (size > 12 && (size <= 64 || size == 108)) {
+		result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
+		result->width    =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
+		result->height   =  (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+		result->bits     =  (((unsigned int)dim[15]) <<  8) +  ((unsigned int)dim[14]);
+	} else {
+		return NULL;
+	}
 
 	return result;
 }