Skip to content

Fix Bug #75785: Add extra check for Maker's Note endianness #5849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Fix Bug #75785: Add extra check for Maker's Note endianness #5849

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e6eb79e
Attempt switching endianness on Maker's Note
nawarian Jul 12, 2020
6fcca53
Set MAX_IFD_NESTING_LEVEL to 200
nawarian Jul 12, 2020
5c21532
Add test case for Bug #75785
nawarian Aug 6, 2020
91a566f
Resize image to 1x1 keeping EXIF data
nawarian Aug 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions ext/exif/exif.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ typedef unsigned char uchar;

#define EFREE_IF(ptr) if (ptr) efree(ptr)

#define MAX_IFD_NESTING_LEVEL 150
#define MAX_IFD_NESTING_LEVEL 200

/* {{{ arginfo */
ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
Expand Down Expand Up @@ -3173,6 +3173,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

/* It can be that motorola_intel is wrongly mapped, let's try inverting it */
if ((2+NumDirEntries*12) > value_len) {
exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");

ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
}

if ((2+NumDirEntries*12) > value_len) {
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
return FALSE;
}
if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
return FALSE;
}

switch (maker_note->offset_mode) {
case MN_OFFSET_MAKER:
offset_base = value_ptr;
Expand Down Expand Up @@ -3203,15 +3220,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
break;
}

if ((2+NumDirEntries*12) > value_len) {
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
return FALSE;
}
if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
return FALSE;
}

for (de=0;de<NumDirEntries;de++) {
size_t offset = 2 + 12 * de;
if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
Expand Down
Binary file added ext/exif/tests/bug75785/P1000506.JPG
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
17 changes: 17 additions & 0 deletions ext/exif/tests/bug75785/bug75785.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
--TEST--
Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);

echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
?>
===DONE===
--EXPECTF--
38/1
122/1
===DONE===