Make MAX_IFD_NESTING_LEVEL an actual nesting level

Currently we only ever increment ifd_nesting_level, so this ends up
being a limit on the total number of IFD tags and we regularly get

Make MAX_IFD_NESTING_LEVEL an actual nesting level

Currently we only ever increment ifd_nesting_level, so this ends up
being a limit on the total number of IFD tags and we regularly get
bug reports of it being exceeded. I think the intention behind this
limit was to prevent recursion stack overflow, and for that we only
need to check actual recursive usage. I've implemented that here,
and dropped the nesting limit down to a smaller value
(which still passes our tests).

However, it seems that we do also need to have a total limit on
the number of tags, as we don't catch some instances of infinite
looping otherwise. Add this as a separate limit with a higher
value, that should hopefully be sufficient.

This is expected to fix a number of bugs:

https://bugs.php.net/bug.php?id=78083
https://bugs.php.net/bug.php?id=78701
https://bugs.php.net/bug.php?id=79907
https://bugs.php.net/bug.php?id=80016

show more ...

Fix bug #75785 by attempt switching endianness on Maker's Note

Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big ref

Fix bug #75785 by attempt switching endianness on Maker's Note

Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big refactor and a gigantic lookup
table, this commit simply attempts to switch the
endianness and proceed when values are acceptable.

Closes GH-5849.

show more ...

Fix #79687: Sony picture - PHP Warning - Make, Model, MakerNotes

Even if the length of a maker note does not match our expectations
(either because the maker note is corrupted, or becaus

Fix #79687: Sony picture - PHP Warning - Make, Model, MakerNotes

Even if the length of a maker note does not match our expectations
(either because the maker note is corrupted, or because our
expectations do not quite match reality), there is no need to let
parsing fail; we can still go on parsing the other meta information.

show more ...

Fixed bug #79282

Fixed bug #79282

Fix bug #78793

Fix build - no model field anymore

Fixed bug #78910

Avoid float to int cast UB in exif

Remove redundant components < 0 check

components is an unsigned number, it cannot be smaller than zero.

Fix leak of temporary buffer during exif tag reading

Fix multiple leaks in exif_read_data()

This fixes two leaks related to duplicate tags, as well as a leak
of zero-length FMT_(S)BYTE with non-null value. This can show up
for MAKERNOT

Fix multiple leaks in exif_read_data()

This fixes two leaks related to duplicate tags, as well as a leak
of zero-length FMT_(S)BYTE with non-null value. This can show up
for MAKERNOTE values where the original length is non-zero, but
the first character is a null byte.

show more ...

Fix out-of-bounds read in exif tag reading

This issue was recently introduced in c739023a50876e2a90588f915803b0140a95638e,
when the restriction that components>0 has been relaxed. We now

Fix out-of-bounds read in exif tag reading

This issue was recently introduced in c739023a50876e2a90588f915803b0140a95638e,
when the restriction that components>0 has been relaxed. We now need
to make sure that any tags that expect at least one component check
that this is the case.

show more ...

Fix exif leak on duplicate copyright tags

Fix exif build

As of PHP 7.3.0 the `model` field is removed.

Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)

Fixed bug #78333

Don't dereference float/double values at unknown address, instead
memcpy it into an aligned stack slot and dereference that.

Fixed bug #78333

Don't dereference float/double values at unknown address, instead
memcpy it into an aligned stack slot and dereference that.

Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)

Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)

Fix bug #77988 - heap-buffer-overflow on php_jpg_get16

Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG

I do not completely understand what is going on there, but I am pretty
sure dir_entry <= offset_base if not a

Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG

I do not completely understand what is going on there, but I am pretty
sure dir_entry <= offset_base if not a normal situation, so we better not
to rely on such dir_entry.

show more ...

fix paste issue

Pointer arithmetic on void pointers is illegal

We quick-fix this by casting to char*; it might be more appropriate to
use char pointers in the first place.

Fixed bug #77831 - Heap-buffer-overflow in exif_iif_add_value in EXIF