4b401f
bug68113.phpt removed as binary patch not supported
4b401f
4b401f
4b401f
From 287c91c1f060dc85a8bdb51488c50db8614448b7 Mon Sep 17 00:00:00 2001
4b401f
From: Stanislav Malyshev <stas@php.net>
4b401f
Date: Sun, 28 Sep 2014 16:57:42 -0700
4b401f
Subject: [PATCH] Fix bug #68113 (Heap corruption in exif_thumbnail())
4b401f
4b401f
---
4b401f
 NEWS                         |   6 +++++-
4b401f
 ext/exif/exif.c              |   4 ++--
4b401f
 ext/exif/tests/bug68113.jpg  | Bin 0 -> 368 bytes
4b401f
 ext/exif/tests/bug68113.phpt |  17 +++++++++++++++++
4b401f
 4 files changed, 24 insertions(+), 3 deletions(-)
4b401f
 create mode 100755 ext/exif/tests/bug68113.jpg
4b401f
 create mode 100644 ext/exif/tests/bug68113.phpt
4b401f
4b401f
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
4b401f
index 38907b4..637ebf9 100644
4b401f
--- a/ext/exif/exif.c
4b401f
+++ b/ext/exif/exif.c
4b401f
@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
4b401f
 					data_ptr += 8;
4b401f
 					break;
4b401f
 				case TAG_FMT_SINGLE:
4b401f
-					memmove(data_ptr, &info_data->value.f, byte_count);
4b401f
+					memmove(data_ptr, &info_value->f, 4);
4b401f
 					data_ptr += 4;
4b401f
 					break;
4b401f
 				case TAG_FMT_DOUBLE:
4b401f
-					memmove(data_ptr, &info_data->value.d, byte_count);
4b401f
+					memmove(data_ptr, &info_value->d, 8);
4b401f
 					data_ptr += 8;
4b401f
 					break;
4b401f
 			}
4b401f
-- 
4b401f
2.1.0
4b401f