Re: [PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/ext/exif/exif.c branches/PHP_5_3/ext/exif/tests/bug54002.phpt branches/PHP_5_3/ext/exif/tests/bug54002_1.jpeg branches/PHP_5_3/ext/exif/tests/bug54002_2.jpeg trunk/ext/exif/exif.c trunk/ext/exif/tests

[Dmitry Stogov]

On 02/15/2011 03:31 PM, Pierre Joye wrote:

On Tue, Feb 15, 2011 at 12:54 PM, Dmitry Stogov<dmi...@zend.com>  wrote:

I don't know all the logic but it looks very strange

2147483648 == 0x80000000 != 0x7fffffff == 2147483647

so byte_count_signed may be 0x80000000 == -1

negative value are checked before. Btw, byte_count_signed  is a 64bit
signed integer, for this reason :)

Lets byte_count_signed = 0x0000000080000000

it's not less than zero and not greater than 2147483648.
So the following condition is false.

if (byte_count_signed < 0 || (byte_count_signed > 2147483648)) {

Then you convert it to size_t.

byte_count = (size_t)byte_count_signed;

In case size_t is defined as signed int32 you will get byte_count = -1.

Thanks. Dmitry

Cheers,

--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php