Skip to content

Commit c14eb8d

Browse files
committed
Fix bug #78793
1 parent d348cfb commit c14eb8d

File tree

2 files changed

+15
-2
lines changed

2 files changed

+15
-2
lines changed

ext/exif/exif.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3240,8 +3240,9 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
32403240
}
32413241

32423242
for (de=0;de<NumDirEntries;de++) {
3243-
if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
3244-
offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
3243+
size_t offset = 2 + 12 * de;
3244+
if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
3245+
offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
32453246
return FALSE;
32463247
}
32473248
}

ext/exif/tests/bug78793.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
Bug #78793: Use-after-free in exif parsing under memory sanitizer
3+
--FILE--
4+
<?php
5+
$f = "ext/exif/tests/bug77950.tiff";
6+
for ($i = 0; $i < 10; $i++) {
7+
@exif_read_data($f);
8+
}
9+
?>
10+
===DONE===
11+
--EXPECT--
12+
===DONE===

0 commit comments

Comments
 (0)