Skip to content

Instantly share code, notes, and snippets.

/73737.diff Secret

Created Jan 1, 2017
What would you like to do?
Patch for 73737
commit 1cda0d7c2ffb62d8331c64e703131d9cabdc03ea
Author: Stanislav Malyshev <>
Date: Sat Dec 31 19:31:49 2016 -0800
Fix bug #73737 FPE when parsing a tag format
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 8b0e34c..83daee6 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
if (s_den == 0) {
return 0;
} else {
- return php_ifd_get32s(value, motorola_intel) / s_den;
+ return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
case TAG_FMT_SSHORT: return php_ifd_get16u(value, motorola_intel);
diff --git a/ext/exif/tests/bug73737.phpt b/ext/exif/tests/bug73737.phpt
new file mode 100644
index 0000000..21eaf80
--- /dev/null
+++ b/ext/exif/tests/bug73737.phpt
@@ -0,0 +1,12 @@
+Bug #73737 (Crash when parsing a tag format)
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+ $exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+ var_dump($exif);
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
diff --git a/ext/exif/tests/bug73737.tiff b/ext/exif/tests/bug73737.tiff
new file mode 100644
index 0000000..2cb036f
Binary files /dev/null and b/ext/exif/tests/bug73737.tiff differ
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.