exif_read_data warns about Illegal IFD size on some images

[akkana]

Description

(Split off from my comment in issue #9397)

The following code:

<?php
exif_read_data("img_5405.jpg", 0, true);
?>

Resulted in this output:

[php:warn] [pid 949] [client 127.0.0.1:36226] PHP Warning:  exif_read_data(img_5405.jpg): Illegal IFD size in /home/akkana/web/tmp/exif-ifdsize/index.php on line 20

But I expected this output instead: (no warning).

A live test is available at: https://shallowsky.com/tmp/exif-ifdsize/
and the code it's using (index.php) can be downloaded here: https://shallowsky.com/tmp/exif-ifdsize/index.php.txt
The image: http://localhost/tmp/exif-ifdsize/img_5405.jpg
and I've also attached the files here:

index.php.txt

I see this both on my local machine (PHP 8.2 from Debian sid) and on my web server (PHP 7.3 on Debian 10 buster).

exiftool doesn't seem to have any complaints about the image's exif.

PHP Version

PHP 8.2

Operating System

No response

[nielsdos]

I can reproduce this on 8.1+
It's this if that is hit: https://github.com/php/php-src/blob/master/ext/exif/exif.c#L3630-L3633

When trying to check the offset, the offset is at the end, which will make the if branch execute.

[cmb69]

Problem is here:

php-src/ext/exif/exif.c

Lines 3639 to 3646 in 1aaf2b1

	/*
	* Hack to make it process IDF1 I hope
	* There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
	*/
	if (!exif_offset_info_contains(info, dir_start+2+NumDirEntries*12, 4)) {
	exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
	return false;
	}

exif_offset_info_contains() fails, and so the warning is triggered, and we return false. It seems to me that 082aecf correctly inserted the length check, but should have returned true (without warning). If I make this change, I get this var_dump() output

exif1.txt

which looks pretty good.

@akkana, can you confirm that this is pretty much what you would expect?

[akkana]

@cmb69 Looks good to me, thanks! I've only skimmed through the dumped array, but it looks like it still has all the EXIF tags, and gets rid of the warning.

[cmb69]

Yeah, it even has a couple more. :)