Permalink
Browse files

Fix bug #73737 FPE when parsing a tag format

  • Loading branch information...
smalyshev committed Jan 1, 2017
1 parent e524658 commit 1cda0d7c2ffb62d8331c64e703131d9cabdc03ea
Showing with 13 additions and 1 deletion.
  1. +1 −1 ext/exif/exif.c
  2. +12 −0 ext/exif/tests/bug73737.phpt
  3. BIN ext/exif/tests/bug73737.tiff
View
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
if (s_den == 0) {
return 0;
} else {
return php_ifd_get32s(value, motorola_intel) / s_den;
return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
}
case TAG_FMT_SSHORT: return php_ifd_get16u(value, motorola_intel);
@@ -0,0 +1,12 @@
--TEST--
Bug #73737 (Crash when parsing a tag format)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
var_dump($exif);
?>
--EXPECTF--
Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
bool(false)
Binary file not shown.

0 comments on commit 1cda0d7

Please sign in to comment.