PHP :: Bug #72682 :: exif_read_data() fails to read all data for some images

Bug #72682

exif_read_data() fails to read all data for some images

Submitted:

2016-07-26 17:50 UTC

Modified:

2018-01-04 15:52 UTC

Votes:	1
Avg. Score:	5.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	1 (100.0%)

From:

r dot helm at helm-software dot de

Assigned:

kalle (profile)

Status:

Closed

Package:

EXIF related

PHP Version:

7.0.9

OS:

Private report:

CVE-ID:

None

View Developer Edit

Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.

php.net Username: php.net Password:

Quick Fix:	(description)
	Block user comment
Status:		Assign to:
Package:
Bug Type:
Summary:
From:	r dot helm at helm-software dot de
New email:
PHP Version:		OS:

New/Additional Comment:

[2016-07-26 17:50 UTC] r dot helm at helm-software dot de

Description:
------------
Since version 7.0.9 exif_read_data() fails to read out all the tags and sections for some images, e.g. images shot with a DJI drone.

Example image: http://hs12.de/exif/image.jpg

The expected result comes from running the script with php version 7.0.8. The actual result comes from 7.0.9.

This was most likely caused by one of the exif changes in 7.0.9:
#72603	Out of bound read in exif_process_IFD_in_MAKERNOTE
#72618	NULL Pointer Dereference in exif_process_user_comment

So it probably has to do with the makernote or usercomment tags that are in these images.



Test script:
---------------
<?php
$exif = exif_read_data("image.jpg", null, true);
var_dump($exif);

Expected result:
----------------
array(8) {
  ["FILE"]=>
  array(6) {
    ["FileName"]=>
    string(9) "image.jpg"
    ["FileDateTime"]=>
    int(1469549406)
    ["FileSize"]=>
    int(5199843)
    ["FileType"]=>
    int(2)
    ["MimeType"]=>
    string(10) "image/jpeg"
    ["SectionsFound"]=>
    string(51) "ANY_TAG, IFD0, THUMBNAIL, EXIF, GPS, INTEROP, WINXP"
  }
  ["COMPUTED"]=>
  array(8) {
    ["html"]=>
    string(26) "width="4000" height="3000""
    ["Height"]=>
    int(3000)
    ["Width"]=>
    int(4000)
    ["IsColor"]=>
    int(1)
    ["ByteOrderMotorola"]=>
    int(0)
    ["ApertureFNumber"]=>
    string(5) "f/2.8"
    ["Thumbnail.FileType"]=>
    int(2)
    ["Thumbnail.MimeType"]=>
    string(10) "image/jpeg"
  }
  ["IFD0"]=>
  array(14) {
    ["ImageDescription"]=>
    string(26) "DCIM\100MEDIA\DJI_0413.JPG"
    ["Make"]=>
    string(3) "DJI"
    ["Model"]=>
    string(6) "FC300X"
    ["Orientation"]=>
    int(1)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["Software"]=>
    string(11) "v01.30.5036"
    ["DateTime"]=>
    string(19) "2016:07:26 11:32:59"
    ["YCbCrPositioning"]=>
    int(1)
    ["Exif_IFD_Pointer"]=>
    int(182)
    ["GPS_IFD_Pointer"]=>
    int(686)
    ["Comments"]=>
    string(128) "0�.�9�.�1�3�8�������������������������������������������������������������������������������������������������������������������"
    ["Keywords"]=>
    string(16) "N���������������"
  }
  ["THUMBNAIL"]=>
  array(6) {
    ["Compression"]=>
    int(6)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["JPEGInterchangeFormat"]=>
    int(41972)
    ["JPEGInterchangeFormatLength"]=>
    int(8065)
  }
  ["EXIF"]=>
  array(39) {
    ["ExposureTime"]=>
    string(12) "1206/1000000"
    ["FNumber"]=>
    string(7) "280/100"
    ["ExposureProgram"]=>
    int(2)
    ["ISOSpeedRatings"]=>
    int(100)
    ["ExifVersion"]=>
    string(4) "0230"
    ["DateTimeOriginal"]=>
    string(19) "2016:07:26 11:32:59"
    ["DateTimeDigitized"]=>
    string(19) "2016:07:26 11:32:59"
    ["ComponentsConfiguration"]=>
    string(4) "�"
    ["CompressedBitsPerPixel"]=>
    string(15) "4861324/1500000"
    ["ShutterSpeedValue"]=>
    string(11) "-9695/-1000"
    ["ApertureValue"]=>
    string(7) "200/100"
    ["ExposureBiasValue"]=>
    string(6) "-11/32"
    ["MaxApertureValue"]=>
    string(7) "200/100"
    ["SubjectDistance"]=>
    string(5) "0/100"
    ["MeteringMode"]=>
    int(2)
    ["LightSource"]=>
    int(1)
    ["Flash"]=>
    int(32)
    ["FocalLength"]=>
    string(7) "361/100"
    ["MakerNote"]=>
    string(256) "������DJI����������������̽�������L���������������ff��������������33�	������̳�
�����f�������������������������������������������������������������������������������������������������������������������������������������"
    ["FlashPixVersion"]=>
    string(4) "0010"
    ["ColorSpace"]=>
    int(1)
    ["ExifImageWidth"]=>
    int(4000)
    ["ExifImageLength"]=>
    int(3000)
    ["InteroperabilityOffset"]=>
    int(656)
    ["ExposureIndex"]=>
    string(3) "0/0"
    ["FileSource"]=>
    string(1) ""
    ["SceneType"]=>
    string(1) "�"
    ["CustomRendered"]=>
    int(0)
    ["ExposureMode"]=>
    int(0)
    ["WhiteBalance"]=>
    int(0)
    ["DigitalZoomRatio"]=>
    string(3) "0/0"
    ["FocalLengthIn35mmFilm"]=>
    int(20)
    ["SceneCaptureType"]=>
    int(0)
    ["GainControl"]=>
    int(0)
    ["Contrast"]=>
    int(0)
    ["Saturation"]=>
    int(0)
    ["Sharpness"]=>
    int(0)
    ["DeviceSettingDescription"]=>
    string(4) "����"
    ["SubjectDistanceRange"]=>
    int(0)
  }
  ["GPS"]=>
  array(7) {
    ["GPSVersion"]=>
    string(4) "��"
    ["GPSLatitudeRef"]=>
    string(1) "N"
    ["GPSLatitude"]=>
    array(3) {
      [0]=>
      string(4) "50/1"
      [1]=>
      string(3) "1/1"
      [2]=>
      string(12) "185831/10000"
    }
    ["GPSLongitudeRef"]=>
    string(1) "E"
    ["GPSLongitude"]=>
    array(3) {
      [0]=>
      string(4) "10/1"
      [1]=>
      string(3) "9/1"
      [2]=>
      string(12) "435465/10000"
    }
    ["GPSAltitudeRef"]=>
    string(1) "�"
    ["GPSAltitude"]=>
    string(11) "177330/1000"
  }
  ["INTEROP"]=>
  array(2) {
    ["InterOperabilityIndex"]=>
    string(3) "R98"
    ["InterOperabilityVersion"]=>
    string(4) "0100"
  }
  ["WINXP"]=>
  array(2) {
    ["Comments"]=>
    string(1) "0"
    ["Keywords"]=>
    string(1) "N"
  }
}


Actual result:
--------------
array(4) {
  ["FILE"]=>
  array(6) {
    ["FileName"]=>
    string(9) "image.jpg"
    ["FileDateTime"]=>
    int(1469549406)
    ["FileSize"]=>
    int(5199843)
    ["FileType"]=>
    int(2)
    ["MimeType"]=>
    string(10) "image/jpeg"
    ["SectionsFound"]=>
    string(19) "ANY_TAG, IFD0, EXIF"
  }
  ["COMPUTED"]=>
  array(6) {
    ["html"]=>
    string(26) "width="4000" height="3000""
    ["Height"]=>
    int(3000)
    ["Width"]=>
    int(4000)
    ["IsColor"]=>
    int(1)
    ["ByteOrderMotorola"]=>
    int(0)
    ["ApertureFNumber"]=>
    string(5) "f/2.8"
  }
  ["IFD0"]=>
  array(10) {
    ["ImageDescription"]=>
    string(26) "DCIM\100MEDIA\DJI_0413.JPG"
    ["Make"]=>
    string(3) "DJI"
    ["Model"]=>
    string(6) "FC300X"
    ["Orientation"]=>
    int(1)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["Software"]=>
    string(11) "v01.30.5036"
    ["DateTime"]=>
    string(19) "2016:07:26 11:32:59"
    ["YCbCrPositioning"]=>
    int(1)
  }
  ["EXIF"]=>
  array(18) {
    ["ExposureTime"]=>
    string(12) "1206/1000000"
    ["FNumber"]=>
    string(7) "280/100"
    ["ExposureProgram"]=>
    int(2)
    ["ISOSpeedRatings"]=>
    int(100)
    ["ExifVersion"]=>
    string(4) "0230"
    ["DateTimeOriginal"]=>
    string(19) "2016:07:26 11:32:59"
    ["DateTimeDigitized"]=>
    string(19) "2016:07:26 11:32:59"
    ["ComponentsConfiguration"]=>
    string(4) "�"
    ["CompressedBitsPerPixel"]=>
    string(15) "4861324/1500000"
    ["ShutterSpeedValue"]=>
    string(11) "-9695/-1000"
    ["ApertureValue"]=>
    string(7) "200/100"
    ["ExposureBiasValue"]=>
    string(6) "-11/32"
    ["MaxApertureValue"]=>
    string(7) "200/100"
    ["SubjectDistance"]=>
    string(5) "0/100"
    ["MeteringMode"]=>
    int(2)
    ["LightSource"]=>
    int(1)
    ["Flash"]=>
    int(32)
    ["FocalLength"]=>
    string(7) "361/100"
  }
}

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2016-07-28 04:44 UTC] laruence@php.net

-Assigned To: +Assigned To: stas

[2016-07-28 04:44 UTC] laruence@php.net

seems caused by this commit: Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE

eebcbd5de38a0f1c2876035402cb770e37476519

Stas, could you please take a look?

thanks

[2016-07-29 11:56 UTC] r dot helm at helm-software dot de

I did some debugging and found that with my test image exif_process_IFD_in_MAKERNOTE() returns FALSE here: https://github.com/php/php-src/blob/9d582eba7448f1495fae62b13d95d2844ce6b28a/ext/exif/exif.c#L2716

And then the conditional added in that commit (https://github.com/php/php-src/commit/eebcbd5de38a0f1c2876035402cb770e37476519#diff-c163453976b65334f071d1d4f976ef45R3086) gets executed and will stop further parsing.

Maybe it should return TRUE at that point because this is not a parsing error?

[2016-08-03 10:02 UTC] kalle@php.net

-Status: Assigned +Status: Feedback -Assigned To: stas +Assigned To: kalle

[2016-08-03 10:02 UTC] kalle@php.net

Please try using this snapshot:

  http://snaps.php.net/php-trunk-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

Gonna steal this one from you Stas. Me and @remi are working on a patch to hopefully resolve this, along with a few other EXIF related bugs at the same time.

[2016-08-03 13:51 UTC] r dot helm at helm-software dot de

It's not fixed.

Take a look at my previous comment. In exif_process_IFD_in_MAKERNOTE() it goes through maker_note_array to see if it knowns how to parse the makernote of this image. If it doesn't find anything it returns FALSE, which was probably intended to mean that it did not process the makernote.
Previously the result of this function was ignored but now when it returns false parsing is stopped.
So i think it should return TRUE.

[2016-08-03 14:38 UTC] kalle@php.net

-Status: Feedback +Status: Assigned

[2016-08-03 15:33 UTC] kalle@php.net

Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)

[2016-08-03 15:33 UTC] kalle@php.net

-Status: Assigned +Status: Closed

[2016-08-22 07:44 UTC] sina dot raudszus at heg dot com

as stated in the last comment from [2016-08-03 13:51 UTC]
it is not fixed.

we've got customers who complain about it.
could you do something about this please?

[2016-10-10 11:17 UTC] krakjoe@php.net

Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)

[2016-11-23 12:09 UTC] php at barryhunter dot co dot uk

Think have the same issue, and have a test case that still fails:
http://cake.geograph.org.uk/exif/_exif_test-andrew.php

This image: http://cake.geograph.org.uk/exif/IMG_6216.org.JPG still fails to read completely. Stipping the makernote from the image (via exiftool), allows the full data to be see by exif_read_data function. 

Its a image from a Canon camera. 

This is against 5.6.28, but the original issues, and potential fix appear to be backported.

[2017-01-12 09:12 UTC] krakjoe@php.net

Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)

[2018-01-04 15:24 UTC] antonin dot roussel at laposte dot net

PHP Version 5.6.32
Got 5 Canon pictures which thumbnail don't load in exif_thumbnail, nor in exif_read_data.
To read IFD0.Make exif tag, you can use "exiftool -make *.jpg"
Make                            : Canon

Event after reprocessing the thumbnail with "exiftran -g -ip *.jpg" the problem persists.

When replacing IFD0.Make string "Canon" with "canon", the thumbnail can be loaded.
"exiftool -make=canon your_Canon_picture.jpg"
PEL PHP Exif Library also allows you to edit IFD0.Make field

Don't know all possible consequences of this edit.

[2018-01-04 15:52 UTC] kalle@php.net

Given the 5.x series is in security mode, the only way to get this fixed is by upgrading to 7.2 (where this bug and a lot of others are fixed)

[2019-04-11 09:04 UTC] johny dot de dot witte at gmail dot com

This problem persists in PHP 7.2.
Photos from DJI Mavic Air

[2020-04-23 21:26 UTC] johnny at kattouf dot com

Hello,

Having similar issue  with Images from Sony Camera processed through DXO Labs.
Exif it not reading keywords and title in 7.2 7.3 and 7.4.5

Works fine when i switch to 5.6

using this to test but result are partial:

<?php
$exif_info1 = @exif_read_data( "test1.jpg", 0, true );
var_dump($exif_info1);
;

?>

https://ibb.co/BGHDqcf
https://ibb.co/gr7jfmn

thanks

/J

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Nov 21 10:01:29 2024 UTC