summaryrefslogtreecommitdiffstats
path: root/php-bug77563.patch
blob: 2fc6dea7086512f8b8a1bd0c9f36a0939684b70b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
From ac4a9cd56f8145c0b1226fe977772a40e3a994a9 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sat, 2 Mar 2019 15:07:40 -0800
Subject: [PATCH] Fix bug #77563 - Uninitialized read in
 exif_process_IFD_in_MAKERNOTE

Also fix for bug #77659

(cherry picked from commit 8ac6fee8562533a15db90062117210ed28b44fea)
---
 ext/exif/exif.c              |   3 ++-
 ext/exif/tests/bug77563.jpg  | Bin 0 -> 63 bytes
 ext/exif/tests/bug77563.phpt |  16 ++++++++++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 ext/exif/tests/bug77563.jpg
 create mode 100644 ext/exif/tests/bug77563.phpt

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 5497068fb1..ce8db170c7 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2751,7 +2751,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}
 
-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -2804,6 +2804,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}