File php-CVE-2018-14851.patch of Package php5.14231

Index: php-5.5.14/ext/exif/exif.c
===================================================================
--- php-5.5.14.orig/ext/exif/exif.c	2018-08-04 09:58:31.346761881 +0200
+++ php-5.5.14/ext/exif/exif.c	2018-08-04 09:58:31.354761924 +0200
@@ -2731,6 +2731,7 @@ static int exif_process_IFD_in_MAKERNOTE
 	int NumDirEntries, old_motorola_intel, offset_diff;
 	const maker_note_type *maker_note;
 	char *dir_start;
+	int data_len;
 
 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
@@ -2779,6 +2780,7 @@ static int exif_process_IFD_in_MAKERNOTE
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
+			data_len = value_len;
 			break;
 		case MN_OFFSET_GUESS:
 			if (maker_note->offset + 10 + 4 >= value_len) {
@@ -2795,6 +2797,7 @@ static int exif_process_IFD_in_MAKERNOTE
 				return FALSE;
 			}
 			offset_base = value_ptr + offset_diff;
+			data_len = value_len - offset_diff;
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
@@ -2808,7 +2811,7 @@ static int exif_process_IFD_in_MAKERNOTE
 
 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
 			return FALSE;
 		}
 	}