ID: 44388 Updated by: [EMAIL PROTECTED] Reported By: jon at tgpsolutions dot com -Status: Open +Status: Verified Bug Type: Reproducible crash Operating System: Linux PHP Version: 5.2.5 New Comment:
Large backtrace follows. #0 0x00082ab1 in php_ifd_get16u (value=0x8bf06987, motorola_intel=0) at /Users/scott/dev/php5_3/ext/exif/exif.c:1088 #1 0x00083cfa in exif_iif_add_value (image_info=0xbffff344, section_index=13, name=0xbfffec4c "ModeArray", tag=1, format=3, length=46, value=0x8bf06987, motorola_intel=0) at /Users/scott/dev/php5_3/ext/exif/exif.c:1754 #2 0x00083e91 in exif_iif_add_tag (image_info=0xbffff344, section_index=13, name=0xbfffec4c "ModeArray", tag=1, format=3, length=46, value=0x8bf06987) at /Users/scott/dev/php5_3/ext/exif/exif.c:1804 #3 0x00086885 in exif_process_IFD_TAG (ImageInfo=0xbffff344, dir_entry=0x58ca8e "\001", offset_base=0x8bf065ed <Address 0x8bf065ed out of bounds>, IFDlength=24553, displacement=684, section_index=13, ReadNextIFD=0, tag_table=0x43fd60) at /Users/scott/dev/php5_3/ext/exif/exif.c:3124 #4 0x0008623b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0xbffff344, value_ptr=0x58c7e0 "t", value_len=8340, offset_base=0x8bf065ed <Address 0x8bf065ed out of bounds>, IFDlength=24553, displacement=684) at /Users/scott/dev/php5_3/ext/exif/exif.c:2807 #5 0x000871c5 in exif_process_IFD_TAG (ImageInfo=0xbffff344, dir_entry=0x58b416 "|?\a", offset_base=0x58664c "II*", IFDlength=24553, displacement=684, section_index=7, ReadNextIFD=1, tag_table=0x43f440) at /Users/scott/dev/php5_3/ext/exif/exif.c:3078 #6 0x00087480 in exif_process_IFD_in_JPEG (ImageInfo=0xbffff344, dir_start=0x58b36c "\034", offset_base=0x58664c "II*", IFDlength=24553, displacement=684, section_index=7) at /Users/scott/dev/php5_3/ext/exif/exif.c:3152 #7 0x000872f7 in exif_process_IFD_TAG (ImageInfo=0xbffff344, dir_entry=0x58b317 "i?\004", offset_base=0x58664c "II*", IFDlength=24553, displacement=684, section_index=3, ReadNextIFD=1, tag_table=0x43f440) at /Users/scott/dev/php5_3/ext/exif/exif.c:3115 #8 0x00087480 in exif_process_IFD_in_JPEG (ImageInfo=0xbffff344, dir_start=0x58b2b5 "\t", offset_base=0x58664c "II*", IFDlength=24553, displacement=684, section_index=3) at /Users/scott/dev/php5_3/ext/exif/exif.c:3152 #9 0x00087750 in exif_process_TIFF_in_JPEG (ImageInfo=0xbffff344, CharBuf=0x58664c "II*", length=24553, displacement=684) at /Users/scott/dev/php5_3/ext/exif/exif.c:3225 #10 0x0008786a in exif_process_APP1 (ImageInfo=0xbffff344, CharBuf=0x586644 "_?Exif", length=24561, displacement=676) at /Users/scott/dev/php5_3/ext/exif/exif.c:3250 Previous Comments: ------------------------------------------------------------------------ [2008-03-10 06:03:31] jon at tgpsolutions dot com Description: ------------ PHP segfaults trying to read the EXIF data for this image: http://jon.tgpsolutions.com/exif_read_data-bug.jpg I hit this bug initially on PHP 5.2.1 (the version in Ubuntu 7.04), was able to reproduce on PHP 5.2.3-1ubuntu6.3 (the version in Ubuntu 7.10), and was able to reproduce again on PHP 5.2.5 compiled from source. #43630 looks similar to this bug, but it was closed as Bogus with the explaination "This simply tells you that your EXIF information is broken" - maybe the submitter wasn't clear that PHP segfaults after displaying the warnings? The sample image isn't available anymore, so I can't be sure if PHP segfaults or not in their case. Reproduce code: --------------- test.php: <?php $exif = exif_read_data('exif_read_data-bug.jpg'); ?> Expected result: ---------------- $exif contains EXIF data for the image. Actual result: -------------- [EMAIL PROTECTED]:~$ php test.php PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xA92D=UndefinedTa): Illegal format code 0x4320, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xA92D=UndefinedTa): Illegal pointer offset(x74686769 + x7279706F = xE6E1D7D8 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x3220=UndefinedTa): Illegal format code 0x3030, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x3220=UndefinedTa): Illegal pointer offset(x43206565 < x406D2B12) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x6168=UndefinedTa): Illegal format code 0x206E, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x6168=UndefinedTa): Illegal pointer offset(x72694672 < x406D2B1E) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x2065=UndefinedTa): Illegal format code 0x6D49, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x2065=UndefinedTa): Illegal pointer offset(xE1FF2967 + x6E696761 = x506890C8 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xF15F=UndefinedTa): Illegal format code 0x7845, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xF15F=UndefinedTa): Illegal pointer offset(x2A4949 + x6669 = x2AAFB2 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x4C69=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 ... above line repeated many more times... PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 Segmentation fault [EMAIL PROTECTED]:~$ ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=44388&edit=1
