Patch for 73737

73737.diff

commit 1cda0d7c2ffb62d8331c64e703131d9cabdc03ea
Author: Stanislav Malyshev <stas@php.net>
Date:   Sat Dec 31 19:31:49 2016 -0800

    Fix bug #73737 FPE when parsing a tag format

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 8b0e34c..83daee6 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return php_ifd_get32s(value, motorola_intel) / s_den;
+				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
 			}
 
 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
diff --git a/ext/exif/tests/bug73737.phpt b/ext/exif/tests/bug73737.phpt
new file mode 100644
index 0000000..21eaf80
--- /dev/null
+++ b/ext/exif/tests/bug73737.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73737 (Crash when parsing a tag format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
+bool(false)
diff --git a/ext/exif/tests/bug73737.tiff b/ext/exif/tests/bug73737.tiff
new file mode 100644
index 0000000..2cb036f
Binary files /dev/null and b/ext/exif/tests/bug73737.tiff differ