Skip to content

Commit 1c018af

Browse files
committed
Fix shift UB in php_ifd_get32s
1 parent b1196e2 commit 1c018af

File tree

1 file changed

+14
-13
lines changed

1 file changed

+14
-13
lines changed

ext/exif/exif.c

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1457,28 +1457,29 @@ static signed short php_ifd_get16s(void *value, int motorola_intel)
14571457
/* }}} */
14581458

14591459
/* {{{ php_ifd_get32s
1460-
* Convert a 32 bit signed value from file's native byte order */
1461-
static int php_ifd_get32s(void *value, int motorola_intel)
1460+
* Convert a 32 bit unsigned value from file's native byte order */
1461+
static unsigned php_ifd_get32u(void *void_value, int motorola_intel)
14621462
{
1463+
uchar *value = (uchar *) void_value;
14631464
if (motorola_intel) {
1464-
return (((char *)value)[0] << 24)
1465-
| (((uchar *)value)[1] << 16)
1466-
| (((uchar *)value)[2] << 8 )
1467-
| (((uchar *)value)[3] );
1465+
return ((unsigned)value[0] << 24)
1466+
| ((unsigned)value[1] << 16)
1467+
| ((unsigned)value[2] << 8 )
1468+
| ((unsigned)value[3] );
14681469
} else {
1469-
return (((char *)value)[3] << 24)
1470-
| (((uchar *)value)[2] << 16)
1471-
| (((uchar *)value)[1] << 8 )
1472-
| (((uchar *)value)[0] );
1470+
return ((unsigned)value[3] << 24)
1471+
| ((unsigned)value[2] << 16)
1472+
| ((unsigned)value[1] << 8 )
1473+
| ((unsigned)value[0] );
14731474
}
14741475
}
14751476
/* }}} */
14761477

14771478
/* {{{ php_ifd_get32u
1478-
* Write 32 bit unsigned value to data */
1479-
static unsigned php_ifd_get32u(void *value, int motorola_intel)
1479+
* Convert a 32 bit signed value from file's native byte order */
1480+
static unsigned php_ifd_get32s(void *value, int motorola_intel)
14801481
{
1481-
return (unsigned)php_ifd_get32s(value, motorola_intel) & 0xffffffff;
1482+
return (int) php_ifd_get32u(value, motorola_intel);
14821483
}
14831484
/* }}} */
14841485

0 commit comments

Comments
 (0)