php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72682 exif_read_data() fails to read all data for some images
Submitted: 2016-07-26 17:50 UTC Modified: 2016-08-03 14:38 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: r dot helm at helm-software dot de Assigned: kalle
Status: Closed Package: EXIF related
PHP Version: 7.0.9 OS:
Private report: No CVE-ID:
 [2016-07-26 17:50 UTC] r dot helm at helm-software dot de
Description:
------------
Since version 7.0.9 exif_read_data() fails to read out all the tags and sections for some images, e.g. images shot with a DJI drone.

Example image: http://hs12.de/exif/image.jpg

The expected result comes from running the script with php version 7.0.8. The actual result comes from 7.0.9.

This was most likely caused by one of the exif changes in 7.0.9:
#72603	Out of bound read in exif_process_IFD_in_MAKERNOTE
#72618	NULL Pointer Dereference in exif_process_user_comment

So it probably has to do with the makernote or usercomment tags that are in these images.



Test script:
---------------
<?php
$exif = exif_read_data("image.jpg", null, true);
var_dump($exif);

Expected result:
----------------
array(8) {
  ["FILE"]=>
  array(6) {
    ["FileName"]=>
    string(9) "image.jpg"
    ["FileDateTime"]=>
    int(1469549406)
    ["FileSize"]=>
    int(5199843)
    ["FileType"]=>
    int(2)
    ["MimeType"]=>
    string(10) "image/jpeg"
    ["SectionsFound"]=>
    string(51) "ANY_TAG, IFD0, THUMBNAIL, EXIF, GPS, INTEROP, WINXP"
  }
  ["COMPUTED"]=>
  array(8) {
    ["html"]=>
    string(26) "width="4000" height="3000""
    ["Height"]=>
    int(3000)
    ["Width"]=>
    int(4000)
    ["IsColor"]=>
    int(1)
    ["ByteOrderMotorola"]=>
    int(0)
    ["ApertureFNumber"]=>
    string(5) "f/2.8"
    ["Thumbnail.FileType"]=>
    int(2)
    ["Thumbnail.MimeType"]=>
    string(10) "image/jpeg"
  }
  ["IFD0"]=>
  array(14) {
    ["ImageDescription"]=>
    string(26) "DCIM\100MEDIA\DJI_0413.JPG"
    ["Make"]=>
    string(3) "DJI"
    ["Model"]=>
    string(6) "FC300X"
    ["Orientation"]=>
    int(1)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["Software"]=>
    string(11) "v01.30.5036"
    ["DateTime"]=>
    string(19) "2016:07:26 11:32:59"
    ["YCbCrPositioning"]=>
    int(1)
    ["Exif_IFD_Pointer"]=>
    int(182)
    ["GPS_IFD_Pointer"]=>
    int(686)
    ["Comments"]=>
    string(128) "0�.�9�.�1�3�8�������������������������������������������������������������������������������������������������������������������"
    ["Keywords"]=>
    string(16) "N���������������"
  }
  ["THUMBNAIL"]=>
  array(6) {
    ["Compression"]=>
    int(6)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["JPEGInterchangeFormat"]=>
    int(41972)
    ["JPEGInterchangeFormatLength"]=>
    int(8065)
  }
  ["EXIF"]=>
  array(39) {
    ["ExposureTime"]=>
    string(12) "1206/1000000"
    ["FNumber"]=>
    string(7) "280/100"
    ["ExposureProgram"]=>
    int(2)
    ["ISOSpeedRatings"]=>
    int(100)
    ["ExifVersion"]=>
    string(4) "0230"
    ["DateTimeOriginal"]=>
    string(19) "2016:07:26 11:32:59"
    ["DateTimeDigitized"]=>
    string(19) "2016:07:26 11:32:59"
    ["ComponentsConfiguration"]=>
    string(4) "�"
    ["CompressedBitsPerPixel"]=>
    string(15) "4861324/1500000"
    ["ShutterSpeedValue"]=>
    string(11) "-9695/-1000"
    ["ApertureValue"]=>
    string(7) "200/100"
    ["ExposureBiasValue"]=>
    string(6) "-11/32"
    ["MaxApertureValue"]=>
    string(7) "200/100"
    ["SubjectDistance"]=>
    string(5) "0/100"
    ["MeteringMode"]=>
    int(2)
    ["LightSource"]=>
    int(1)
    ["Flash"]=>
    int(32)
    ["FocalLength"]=>
    string(7) "361/100"
    ["MakerNote"]=>
    string(256) "������DJI����������������̽�������L���������������ff��������������33�	������̳�
�����f�������������������������������������������������������������������������������������������������������������������������������������"
    ["FlashPixVersion"]=>
    string(4) "0010"
    ["ColorSpace"]=>
    int(1)
    ["ExifImageWidth"]=>
    int(4000)
    ["ExifImageLength"]=>
    int(3000)
    ["InteroperabilityOffset"]=>
    int(656)
    ["ExposureIndex"]=>
    string(3) "0/0"
    ["FileSource"]=>
    string(1) ""
    ["SceneType"]=>
    string(1) "�"
    ["CustomRendered"]=>
    int(0)
    ["ExposureMode"]=>
    int(0)
    ["WhiteBalance"]=>
    int(0)
    ["DigitalZoomRatio"]=>
    string(3) "0/0"
    ["FocalLengthIn35mmFilm"]=>
    int(20)
    ["SceneCaptureType"]=>
    int(0)
    ["GainControl"]=>
    int(0)
    ["Contrast"]=>
    int(0)
    ["Saturation"]=>
    int(0)
    ["Sharpness"]=>
    int(0)
    ["DeviceSettingDescription"]=>
    string(4) "����"
    ["SubjectDistanceRange"]=>
    int(0)
  }
  ["GPS"]=>
  array(7) {
    ["GPSVersion"]=>
    string(4) "��"
    ["GPSLatitudeRef"]=>
    string(1) "N"
    ["GPSLatitude"]=>
    array(3) {
      [0]=>
      string(4) "50/1"
      [1]=>
      string(3) "1/1"
      [2]=>
      string(12) "185831/10000"
    }
    ["GPSLongitudeRef"]=>
    string(1) "E"
    ["GPSLongitude"]=>
    array(3) {
      [0]=>
      string(4) "10/1"
      [1]=>
      string(3) "9/1"
      [2]=>
      string(12) "435465/10000"
    }
    ["GPSAltitudeRef"]=>
    string(1) "�"
    ["GPSAltitude"]=>
    string(11) "177330/1000"
  }
  ["INTEROP"]=>
  array(2) {
    ["InterOperabilityIndex"]=>
    string(3) "R98"
    ["InterOperabilityVersion"]=>
    string(4) "0100"
  }
  ["WINXP"]=>
  array(2) {
    ["Comments"]=>
    string(1) "0"
    ["Keywords"]=>
    string(1) "N"
  }
}


Actual result:
--------------
array(4) {
  ["FILE"]=>
  array(6) {
    ["FileName"]=>
    string(9) "image.jpg"
    ["FileDateTime"]=>
    int(1469549406)
    ["FileSize"]=>
    int(5199843)
    ["FileType"]=>
    int(2)
    ["MimeType"]=>
    string(10) "image/jpeg"
    ["SectionsFound"]=>
    string(19) "ANY_TAG, IFD0, EXIF"
  }
  ["COMPUTED"]=>
  array(6) {
    ["html"]=>
    string(26) "width="4000" height="3000""
    ["Height"]=>
    int(3000)
    ["Width"]=>
    int(4000)
    ["IsColor"]=>
    int(1)
    ["ByteOrderMotorola"]=>
    int(0)
    ["ApertureFNumber"]=>
    string(5) "f/2.8"
  }
  ["IFD0"]=>
  array(10) {
    ["ImageDescription"]=>
    string(26) "DCIM\100MEDIA\DJI_0413.JPG"
    ["Make"]=>
    string(3) "DJI"
    ["Model"]=>
    string(6) "FC300X"
    ["Orientation"]=>
    int(1)
    ["XResolution"]=>
    string(4) "72/1"
    ["YResolution"]=>
    string(4) "72/1"
    ["ResolutionUnit"]=>
    int(2)
    ["Software"]=>
    string(11) "v01.30.5036"
    ["DateTime"]=>
    string(19) "2016:07:26 11:32:59"
    ["YCbCrPositioning"]=>
    int(1)
  }
  ["EXIF"]=>
  array(18) {
    ["ExposureTime"]=>
    string(12) "1206/1000000"
    ["FNumber"]=>
    string(7) "280/100"
    ["ExposureProgram"]=>
    int(2)
    ["ISOSpeedRatings"]=>
    int(100)
    ["ExifVersion"]=>
    string(4) "0230"
    ["DateTimeOriginal"]=>
    string(19) "2016:07:26 11:32:59"
    ["DateTimeDigitized"]=>
    string(19) "2016:07:26 11:32:59"
    ["ComponentsConfiguration"]=>
    string(4) "�"
    ["CompressedBitsPerPixel"]=>
    string(15) "4861324/1500000"
    ["ShutterSpeedValue"]=>
    string(11) "-9695/-1000"
    ["ApertureValue"]=>
    string(7) "200/100"
    ["ExposureBiasValue"]=>
    string(6) "-11/32"
    ["MaxApertureValue"]=>
    string(7) "200/100"
    ["SubjectDistance"]=>
    string(5) "0/100"
    ["MeteringMode"]=>
    int(2)
    ["LightSource"]=>
    int(1)
    ["Flash"]=>
    int(32)
    ["FocalLength"]=>
    string(7) "361/100"
  }
}


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-07-28 04:44 UTC] laruence@php.net
-Assigned To: +Assigned To: stas
 [2016-07-28 04:44 UTC] laruence@php.net
seems caused by this commit: Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE

eebcbd5de38a0f1c2876035402cb770e37476519

Stas, could you please take a look?

thanks
 [2016-07-29 11:56 UTC] r dot helm at helm-software dot de
I did some debugging and found that with my test image exif_process_IFD_in_MAKERNOTE() returns FALSE here: https://github.com/php/php-src/blob/9d582eba7448f1495fae62b13d95d2844ce6b28a/ext/exif/exif.c#L2716

And then the conditional added in that commit (https://github.com/php/php-src/commit/eebcbd5de38a0f1c2876035402cb770e37476519#diff-c163453976b65334f071d1d4f976ef45R3086) gets executed and will stop further parsing.

Maybe it should return TRUE at that point because this is not a parsing error?
 [2016-08-03 10:02 UTC] kalle@php.net
-Status: Assigned +Status: Feedback -Assigned To: stas +Assigned To: kalle
 [2016-08-03 10:02 UTC] kalle@php.net
Please try using this snapshot:

  http://snaps.php.net/php-trunk-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

Gonna steal this one from you Stas. Me and @remi are working on a patch to hopefully resolve this, along with a few other EXIF related bugs at the same time.
 [2016-08-03 13:51 UTC] r dot helm at helm-software dot de
It's not fixed.

Take a look at my previous comment. In exif_process_IFD_in_MAKERNOTE() it goes through maker_note_array to see if it knowns how to parse the makernote of this image. If it doesn't find anything it returns FALSE, which was probably intended to mean that it did not process the makernote.
Previously the result of this function was ignored but now when it returns false parsing is stopped.
So i think it should return TRUE.
 [2016-08-03 14:38 UTC] kalle@php.net
-Status: Feedback +Status: Assigned
 [2016-08-03 15:33 UTC] kalle@php.net
Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)
 [2016-08-03 15:33 UTC] kalle@php.net
-Status: Assigned +Status: Closed
 [2016-08-22 07:44 UTC] sina dot raudszus at heg dot com
as stated in the last comment from [2016-08-03 13:51 UTC]
it is not fixed.

we've got customers who complain about it.
could you do something about this please?
 [2016-10-10 11:17 UTC] krakjoe@php.net
Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)
 [2016-11-23 12:09 UTC] php at barryhunter dot co dot uk
Think have the same issue, and have a test case that still fails:
http://cake.geograph.org.uk/exif/_exif_test-andrew.php

This image: http://cake.geograph.org.uk/exif/IMG_6216.org.JPG still fails to read completely. Stipping the makernote from the image (via exiftool), allows the full data to be see by exif_read_data function. 

Its a image from a Canon camera. 

This is against 5.6.28, but the original issues, and potential fix appear to be backported.
 [2017-01-12 09:12 UTC] krakjoe@php.net
Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c6bd054b86c52948505be7409ad8d6488db062f6
Log: Fixed bug #72682 (exif_read_data() fails to read all data for some images)
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Fri May 26 16:01:37 2017 UTC