File php7-CVE-2020-7064.patch of Package php7.21654

X-Git-Url: http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fexif%2Fexif.c;h=819708c2d3359dba9ed7004955b450c6ed83b7ff;hp=7fe055f381d792da9c3a6678647800ab58fa834a;hb=41f66e2a2cfd611e35be5ac3bf747f0b56161216;hpb=63f6608f89fda8ad35bc8c5472d1028e6fa6e0c6

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 7fe055f381..819708c2d3 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -3692,6 +3692,11 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;
 
+	if (length < 2) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
+		return;
+	}
+
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3844,7 +3849,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}
 
-		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
 		Data = ImageInfo->file.list[sn].data;
 
 		/* Store first two pre-read bytes. */