@@ -2677,7 +2677,7 @@ static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
2677
2677
/* }}} */
2678
2678
2679
2679
/* forward declarations */
2680
- static int exif_process_IFD_in_JPEG (image_info_type * ImageInfo , char * dir_start , char * offset_base , size_t IFDlength , size_t displacement , int section_index );
2680
+ static int exif_process_IFD_in_JPEG (image_info_type * ImageInfo , char * dir_start , char * offset_base , size_t IFDlength , size_t displacement , int section_index , int tag );
2681
2681
static int exif_process_IFD_TAG ( image_info_type * ImageInfo , char * dir_entry , char * offset_base , size_t IFDlength , size_t displacement , int section_index , int ReadNextIFD , tag_table_type tag_table );
2682
2682
2683
2683
/* {{{ exif_get_markername
@@ -3524,7 +3524,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
3524
3524
exif_error_docref ("exif_read_data#error_ifd" EXIFERR_CC , ImageInfo , E_WARNING , "Illegal IFD Pointer" );
3525
3525
return FALSE;
3526
3526
}
3527
- if (!exif_process_IFD_in_JPEG (ImageInfo , Subdir_start , offset_base , IFDlength , displacement , sub_section_index )) {
3527
+ if (!exif_process_IFD_in_JPEG (ImageInfo , Subdir_start , offset_base , IFDlength , displacement , sub_section_index , tag )) {
3528
3528
return FALSE;
3529
3529
}
3530
3530
#ifdef EXIF_DEBUG
@@ -3541,11 +3541,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
3541
3541
3542
3542
/* {{{ exif_process_IFD_in_JPEG
3543
3543
* Process one of the nested IFDs directories. */
3544
- static int exif_process_IFD_in_JPEG (image_info_type * ImageInfo , char * dir_start , char * offset_base , size_t IFDlength , size_t displacement , int section_index )
3544
+ static int exif_process_IFD_in_JPEG (image_info_type * ImageInfo , char * dir_start , char * offset_base , size_t IFDlength , size_t displacement , int section_index , int tag )
3545
3545
{
3546
3546
int de ;
3547
3547
int NumDirEntries ;
3548
- int NextDirOffset ;
3548
+ int NextDirOffset = 0 ;
3549
3549
3550
3550
#ifdef EXIF_DEBUG
3551
3551
exif_error_docref (NULL EXIFERR_CC , ImageInfo , E_NOTICE , "Process %s (x%04X(=%d))" , exif_get_sectionname (section_index ), IFDlength , IFDlength );
@@ -3585,7 +3585,11 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
3585
3585
exif_error_docref ("exif_read_data#error_ifd" EXIFERR_CC , ImageInfo , E_WARNING , "Illegal IFD size" );
3586
3586
return FALSE;
3587
3587
}
3588
- NextDirOffset = php_ifd_get32u (dir_start + 2 + 12 * de , ImageInfo -> motorola_intel );
3588
+
3589
+ if (tag != TAG_EXIF_IFD_POINTER && tag != TAG_GPS_IFD_POINTER ) {
3590
+ NextDirOffset = php_ifd_get32u (dir_start + 2 + 12 * de , ImageInfo -> motorola_intel );
3591
+ }
3592
+
3589
3593
if (NextDirOffset ) {
3590
3594
/* the next line seems false but here IFDlength means length of all IFDs */
3591
3595
if (offset_base + NextDirOffset < offset_base || offset_base + NextDirOffset > offset_base + IFDlength ) {
@@ -3596,7 +3600,7 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
3596
3600
#ifdef EXIF_DEBUG
3597
3601
exif_error_docref (NULL EXIFERR_CC , ImageInfo , E_NOTICE , "Expect next IFD to be thumbnail" );
3598
3602
#endif
3599
- if (exif_process_IFD_in_JPEG (ImageInfo , offset_base + NextDirOffset , offset_base , IFDlength , displacement , SECTION_THUMBNAIL )) {
3603
+ if (exif_process_IFD_in_JPEG (ImageInfo , offset_base + NextDirOffset , offset_base , IFDlength , displacement , SECTION_THUMBNAIL , 0 )) {
3600
3604
#ifdef EXIF_DEBUG
3601
3605
exif_error_docref (NULL EXIFERR_CC , ImageInfo , E_NOTICE , "Thumbnail size: 0x%04X" , ImageInfo -> Thumbnail .size );
3602
3606
#endif
@@ -3651,7 +3655,7 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
3651
3655
3652
3656
ImageInfo -> sections_found |= FOUND_IFD0 ;
3653
3657
/* First directory starts at offset 8. Offsets starts at 0. */
3654
- exif_process_IFD_in_JPEG (ImageInfo , CharBuf + offset_of_ifd , CharBuf , length /*-14*/ , displacement , SECTION_IFD0 );
3658
+ exif_process_IFD_in_JPEG (ImageInfo , CharBuf + offset_of_ifd , CharBuf , length /*-14*/ , displacement , SECTION_IFD0 , 0 );
3655
3659
3656
3660
#ifdef EXIF_DEBUG
3657
3661
exif_error_docref (NULL EXIFERR_CC , ImageInfo , E_NOTICE , "Process TIFF in JPEG done ");
0 commit comments