Coverage Report

Created: 2026-06-02 06:36

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/ext/exif/exif.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright © The PHP Group and Contributors.                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to the Modified BSD License that is      |
6
   | bundled with this package in the file LICENSE, and is available      |
7
   | through the World Wide Web at <https://www.php.net/license/>.        |
8
   |                                                                      |
9
   | SPDX-License-Identifier: BSD-3-Clause                                |
10
   +----------------------------------------------------------------------+
11
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
12
   |          Marcus Boerger <helly@php.net>                              |
13
   +----------------------------------------------------------------------+
14
 */
15
16
#ifdef HAVE_CONFIG_H
17
#include <config.h>
18
#endif
19
20
#include "php.h"
21
#include "ext/standard/file.h"
22
23
/* When EXIF_DEBUG is defined the module generates a lot of debug messages
24
 * that help understanding what is going on. This can and should be used
25
 * while extending the module as it shows if you are at the right position.
26
 * You are always considered to have a copy of TIFF6.0 and EXIF2.10 standard.
27
 */
28
#undef EXIF_DEBUG
29
30
#ifdef EXIF_DEBUG
31
#define EXIFERR_DC , const char *_file, size_t _line
32
#define EXIFERR_CC , __FILE__, __LINE__
33
#else
34
#define EXIFERR_DC
35
#define EXIFERR_CC
36
#endif
37
38
0
#define USE_MBSTRING zend_hash_str_exists(&module_registry, "mbstring", sizeof("mbstring")-1)
39
40
#include "php_exif.h"
41
#include "exif_arginfo.h"
42
#include <math.h>
43
#include "php_ini.h"
44
#include "ext/standard/php_string.h" /* for php_basename() */
45
#include "ext/standard/php_image.h"
46
#include "ext/standard/info.h"
47
48
/* needed for ssize_t definition */
49
#include <sys/types.h>
50
51
#ifdef __SANITIZE_ADDRESS__
52
# include <sanitizer/asan_interface.h>
53
#endif
54
55
typedef unsigned char uchar;
56
57
#ifndef max
58
# define max(a,b) ((a)>(b) ? (a) : (b))
59
#endif
60
61
647k
#define EFREE_IF(ptr) if (ptr) efree(ptr)
62
63
172k
#define MAX_IFD_NESTING_LEVEL 10
64
173k
#define MAX_IFD_TAGS 1000
65
66
/* {{{ PHP_MINFO_FUNCTION */
67
PHP_MINFO_FUNCTION(exif)
68
0
{
69
0
  php_info_print_table_start();
70
0
  php_info_print_table_row(2, "EXIF Support", "enabled");
71
0
  php_info_print_table_row(2, "Supported EXIF Version", "0220");
72
0
  php_info_print_table_row(2, "Supported filetypes", "JPEG, TIFF");
73
74
0
  if (USE_MBSTRING) {
75
0
    php_info_print_table_row(2, "Multibyte decoding support using mbstring", "enabled");
76
0
  } else {
77
0
    php_info_print_table_row(2, "Multibyte decoding support using mbstring", "disabled");
78
0
  }
79
80
0
  php_info_print_table_row(2, "Extended EXIF tag formats", "Canon, Casio, Fujifilm, Nikon, Olympus, Samsung, Panasonic, DJI, Sony, Pentax, Minolta, Sigma, Foveon, Kyocera, Ricoh, AGFA, Epson");
81
0
  php_info_print_table_end();
82
83
0
  DISPLAY_INI_ENTRIES();
84
0
}
85
/* }}} */
86
87
ZEND_BEGIN_MODULE_GLOBALS(exif)
88
  char * encode_unicode;
89
  char * decode_unicode_be;
90
  char * decode_unicode_le;
91
  char * encode_jis;
92
  char * decode_jis_be;
93
  char * decode_jis_le;
94
  HashTable *tag_table_cache;
95
ZEND_END_MODULE_GLOBALS(exif)
96
97
ZEND_DECLARE_MODULE_GLOBALS(exif)
98
29.8M
#define EXIF_G(v) ZEND_MODULE_GLOBALS_ACCESSOR(exif, v)
99
100
#if defined(ZTS) && defined(COMPILE_DL_EXIF)
101
ZEND_TSRMLS_CACHE_DEFINE()
102
#endif
103
104
/* {{{ PHP_INI */
105
106
ZEND_INI_MH(OnUpdateEncode)
107
4
{
108
4
  if (new_value && ZSTR_LEN(new_value)) {
109
2
    const zend_encoding **return_list;
110
2
    size_t return_size;
111
2
    if (FAILURE == zend_multibyte_parse_encoding_list(ZSTR_VAL(new_value), ZSTR_LEN(new_value),
112
2
  &return_list, &return_size, 0)) {
113
0
      php_error_docref(NULL, E_WARNING, "Illegal encoding ignored: '%s'", ZSTR_VAL(new_value));
114
0
      return FAILURE;
115
0
    }
116
2
    pefree((void *) return_list, 0);
117
2
  }
118
4
  return OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
119
4
}
120
121
ZEND_INI_MH(OnUpdateDecode)
122
8
{
123
8
  if (new_value) {
124
8
    const zend_encoding **return_list;
125
8
    size_t return_size;
126
8
    if (FAILURE == zend_multibyte_parse_encoding_list(ZSTR_VAL(new_value), ZSTR_LEN(new_value),
127
8
  &return_list, &return_size, 0)) {
128
0
      php_error_docref(NULL, E_WARNING, "Illegal encoding ignored: '%s'", ZSTR_VAL(new_value));
129
0
      return FAILURE;
130
0
    }
131
8
    pefree((void *) return_list, 0);
132
8
  }
133
8
  return OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
134
8
}
135
136
PHP_INI_BEGIN()
137
  STD_PHP_INI_ENTRY("exif.encode_unicode",          "ISO-8859-15", PHP_INI_ALL, OnUpdateEncode, encode_unicode,    zend_exif_globals, exif_globals)
138
  STD_PHP_INI_ENTRY("exif.decode_unicode_motorola", "UCS-2BE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_be, zend_exif_globals, exif_globals)
139
  STD_PHP_INI_ENTRY("exif.decode_unicode_intel",    "UCS-2LE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_le, zend_exif_globals, exif_globals)
140
  STD_PHP_INI_ENTRY("exif.encode_jis",              "",            PHP_INI_ALL, OnUpdateEncode, encode_jis,        zend_exif_globals, exif_globals)
141
  STD_PHP_INI_ENTRY("exif.decode_jis_motorola",     "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_be,     zend_exif_globals, exif_globals)
142
  STD_PHP_INI_ENTRY("exif.decode_jis_intel",        "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_le,     zend_exif_globals, exif_globals)
143
PHP_INI_END()
144
/* }}} */
145
146
/* {{{ PHP_GINIT_FUNCTION */
147
static PHP_GINIT_FUNCTION(exif)
148
2
{
149
#if defined(COMPILE_DL_EXIF) && defined(ZTS)
150
  ZEND_TSRMLS_CACHE_UPDATE();
151
#endif
152
2
  exif_globals->encode_unicode    = NULL;
153
2
  exif_globals->decode_unicode_be = NULL;
154
2
  exif_globals->decode_unicode_le = NULL;
155
2
  exif_globals->encode_jis        = NULL;
156
2
  exif_globals->decode_jis_be     = NULL;
157
2
  exif_globals->decode_jis_le     = NULL;
158
2
  exif_globals->tag_table_cache   = NULL;
159
2
}
160
/* }}} */
161
162
/* {{{ PHP_MINIT_FUNCTION(exif) */
163
PHP_MINIT_FUNCTION(exif)
164
2
{
165
2
  REGISTER_INI_ENTRIES();
166
167
2
  register_exif_symbols(module_number);
168
169
2
  return SUCCESS;
170
2
}
171
/* }}} */
172
173
/* {{{ PHP_MSHUTDOWN_FUNCTION */
174
PHP_MSHUTDOWN_FUNCTION(exif)
175
0
{
176
0
  UNREGISTER_INI_ENTRIES();
177
0
  if (EXIF_G(tag_table_cache)) {
178
0
    zend_hash_destroy(EXIF_G(tag_table_cache));
179
0
    free(EXIF_G(tag_table_cache));
180
0
  }
181
0
  return SUCCESS;
182
0
}
183
/* }}} */
184
185
/* {{{ exif dependencies */
186
static const zend_module_dep exif_module_deps[] = {
187
  ZEND_MOD_REQUIRED("standard")
188
  ZEND_MOD_OPTIONAL("mbstring")
189
  ZEND_MOD_END
190
};
191
/* }}} */
192
193
/* {{{ exif_module_entry */
194
zend_module_entry exif_module_entry = {
195
  STANDARD_MODULE_HEADER_EX, NULL,
196
  exif_module_deps,
197
  "exif",
198
  ext_functions,
199
  PHP_MINIT(exif),
200
  PHP_MSHUTDOWN(exif),
201
  NULL, NULL,
202
  PHP_MINFO(exif),
203
  PHP_EXIF_VERSION,
204
  PHP_MODULE_GLOBALS(exif),
205
  PHP_GINIT(exif),
206
  NULL,
207
  NULL,
208
  STANDARD_MODULE_PROPERTIES_EX
209
};
210
/* }}} */
211
212
#ifdef COMPILE_DL_EXIF
213
ZEND_GET_MODULE(exif)
214
#endif
215
216
/* php_stream_read() may return early without reading all data, depending on the chunk size
217
 * and whether it's a URL stream or not. This helper keeps reading until the requested amount
218
 * is read or until there is no more data available to read. */
219
static ssize_t exif_read_from_stream_file_looped(php_stream *stream, char *buf, size_t count)
220
566k
{
221
566k
  size_t total_read = 0;
222
954k
  while (total_read < count) {
223
388k
    ssize_t ret = php_stream_read(stream, buf + total_read, count - total_read);
224
388k
    if (ret == -1) {
225
0
      return -1;
226
0
    }
227
388k
    if (ret == 0) {
228
207
      break;
229
207
    }
230
388k
    total_read += ret;
231
388k
  }
232
566k
  return total_read;
233
566k
}
234
235
/* }}} */
236
237
/* {{{ error messages */
238
static const char *const EXIF_ERROR_FILEEOF   = "Unexpected end of file reached";
239
static const char *const EXIF_ERROR_CORRUPT   = "File structure corrupted";
240
static const char *const EXIF_ERROR_THUMBEOF  = "Thumbnail goes IFD boundary or end of file reached";
241
static const char *const EXIF_ERROR_FSREALLOC = "Illegal reallocating of undefined file section";
242
243
26
#define EXIF_ERRLOG_FILEEOF(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FILEEOF);
244
225
#define EXIF_ERRLOG_CORRUPT(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_CORRUPT);
245
0
#define EXIF_ERRLOG_THUMBEOF(ImageInfo)   exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_THUMBEOF);
246
0
#define EXIF_ERRLOG_FSREALLOC(ImageInfo)  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FSREALLOC);
247
/* }}} */
248
249
/* {{{ format description defines
250
   Describes format descriptor
251
*/
252
static const int php_tiff_bytes_per_format[] = {0, 1, 1, 2, 4, 8, 1, 1, 2, 4, 8, 4, 8, 1};
253
18.5M
#define NUM_FORMATS 13
254
255
15.3M
#define TAG_FMT_BYTE       1
256
1.55M
#define TAG_FMT_STRING     2
257
7.59M
#define TAG_FMT_USHORT     3
258
3.90M
#define TAG_FMT_ULONG      4
259
115k
#define TAG_FMT_URATIONAL  5
260
473k
#define TAG_FMT_SBYTE      6
261
63.3k
#define TAG_FMT_UNDEFINED  7
262
583k
#define TAG_FMT_SSHORT     8
263
1.40M
#define TAG_FMT_SLONG      9
264
478k
#define TAG_FMT_SRATIONAL 10
265
639k
#define TAG_FMT_SINGLE    11
266
247k
#define TAG_FMT_DOUBLE    12
267
126
#define TAG_FMT_IFD       13
268
269
#ifdef EXIF_DEBUG
270
static char *exif_get_tagformat(int format)
271
{
272
  switch(format) {
273
    case TAG_FMT_BYTE:      return "BYTE";
274
    case TAG_FMT_STRING:    return "STRING";
275
    case TAG_FMT_USHORT:    return "USHORT";
276
    case TAG_FMT_ULONG:     return "ULONG";
277
    case TAG_FMT_URATIONAL: return "URATIONAL";
278
    case TAG_FMT_SBYTE:     return "SBYTE";
279
    case TAG_FMT_UNDEFINED: return "UNDEFINED";
280
    case TAG_FMT_SSHORT:    return "SSHORT";
281
    case TAG_FMT_SLONG:     return "SLONG";
282
    case TAG_FMT_SRATIONAL: return "SRATIONAL";
283
    case TAG_FMT_SINGLE:    return "SINGLE";
284
    case TAG_FMT_DOUBLE:    return "DOUBLE";
285
    case TAG_FMT_IFD:       return "IFD";
286
  }
287
  return "*Illegal";
288
}
289
#endif
290
291
/* Describes tag values */
292
#define TAG_GPS_VERSION_ID              0x0000
293
#define TAG_GPS_LATITUDE_REF            0x0001
294
#define TAG_GPS_LATITUDE                0x0002
295
#define TAG_GPS_LONGITUDE_REF           0x0003
296
#define TAG_GPS_LONGITUDE               0x0004
297
#define TAG_GPS_ALTITUDE_REF            0x0005
298
#define TAG_GPS_ALTITUDE                0x0006
299
#define TAG_GPS_TIME_STAMP              0x0007
300
#define TAG_GPS_SATELLITES              0x0008
301
#define TAG_GPS_STATUS                  0x0009
302
#define TAG_GPS_MEASURE_MODE            0x000A
303
#define TAG_GPS_DOP                     0x000B
304
#define TAG_GPS_SPEED_REF               0x000C
305
#define TAG_GPS_SPEED                   0x000D
306
#define TAG_GPS_TRACK_REF               0x000E
307
#define TAG_GPS_TRACK                   0x000F
308
#define TAG_GPS_IMG_DIRECTION_REF       0x0010
309
#define TAG_GPS_IMG_DIRECTION           0x0011
310
#define TAG_GPS_MAP_DATUM               0x0012
311
#define TAG_GPS_DEST_LATITUDE_REF       0x0013
312
#define TAG_GPS_DEST_LATITUDE           0x0014
313
#define TAG_GPS_DEST_LONGITUDE_REF      0x0015
314
#define TAG_GPS_DEST_LONGITUDE          0x0016
315
#define TAG_GPS_DEST_BEARING_REF        0x0017
316
#define TAG_GPS_DEST_BEARING            0x0018
317
#define TAG_GPS_DEST_DISTANCE_REF       0x0019
318
#define TAG_GPS_DEST_DISTANCE           0x001A
319
#define TAG_GPS_PROCESSING_METHOD       0x001B
320
#define TAG_GPS_AREA_INFORMATION        0x001C
321
#define TAG_GPS_DATE_STAMP              0x001D
322
#define TAG_GPS_DIFFERENTIAL            0x001E
323
#define TAG_TIFF_COMMENT                0x00FE /* SHOULDN'T HAPPEN */
324
#define TAG_NEW_SUBFILE                 0x00FE /* New version of subfile tag */
325
#define TAG_SUBFILE_TYPE                0x00FF /* Old version of subfile tag */
326
61.8k
#define TAG_IMAGEWIDTH                  0x0100
327
5.46k
#define TAG_IMAGEHEIGHT                 0x0101
328
#define TAG_BITS_PER_SAMPLE             0x0102
329
#define TAG_COMPRESSION                 0x0103
330
1.14k
#define TAG_PHOTOMETRIC_INTERPRETATION  0x0106
331
#define TAG_THRESHOLDING                0x0107
332
#define TAG_CELL_WIDTH                  0x0108
333
#define TAG_CELL_HEIGHT                 0x0109
334
#define TAG_FILL_ORDER                  0x010A
335
#define TAG_DOCUMENT_NAME               0x010D
336
#define TAG_IMAGE_DESCRIPTION           0x010E
337
2.24k
#define TAG_MAKE                        0x010F
338
125
#define TAG_MODEL                       0x0110
339
356
#define TAG_STRIP_OFFSETS               0x0111
340
#define TAG_ORIENTATION                 0x0112
341
#define TAG_SAMPLES_PER_PIXEL           0x0115
342
#define TAG_ROWS_PER_STRIP              0x0116
343
658
#define TAG_STRIP_BYTE_COUNTS           0x0117
344
#define TAG_MIN_SAMPLE_VALUE            0x0118
345
#define TAG_MAX_SAMPLE_VALUE            0x0119
346
#define TAG_X_RESOLUTION                0x011A
347
#define TAG_Y_RESOLUTION                0x011B
348
#define TAG_PLANAR_CONFIGURATION        0x011C
349
#define TAG_PAGE_NAME                   0x011D
350
#define TAG_X_POSITION                  0x011E
351
#define TAG_Y_POSITION                  0x011F
352
#define TAG_FREE_OFFSETS                0x0120
353
#define TAG_FREE_BYTE_COUNTS            0x0121
354
#define TAG_GRAY_RESPONSE_UNIT          0x0122
355
#define TAG_GRAY_RESPONSE_CURVE         0x0123
356
#define TAG_RESOLUTION_UNIT             0x0128
357
#define TAG_PAGE_NUMBER                 0x0129
358
#define TAG_TRANSFER_FUNCTION           0x012D
359
#define TAG_SOFTWARE                    0x0131
360
#define TAG_DATETIME                    0x0132
361
#define TAG_ARTIST                      0x013B
362
#define TAG_HOST_COMPUTER               0x013C
363
#define TAG_PREDICTOR                   0x013D
364
#define TAG_WHITE_POINT                 0x013E
365
#define TAG_PRIMARY_CHROMATICITIES      0x013F
366
#define TAG_COLOR_MAP                   0x0140
367
#define TAG_HALFTONE_HINTS              0x0141
368
#define TAG_TILE_WIDTH                  0x0142
369
#define TAG_TILE_LENGTH                 0x0143
370
#define TAG_TILE_OFFSETS                0x0144
371
#define TAG_TILE_BYTE_COUNTS            0x0145
372
151k
#define TAG_SUB_IFD                     0x014A
373
#define TAG_INK_SET                     0x014C
374
#define TAG_INK_NAMES                   0x014D
375
#define TAG_NUMBER_OF_INKS              0x014E
376
#define TAG_DOT_RANGE                   0x0150
377
#define TAG_TARGET_PRINTER              0x0151
378
#define TAG_EXTRA_SAMPLE                0x0152
379
#define TAG_SAMPLE_FORMAT               0x0153
380
#define TAG_S_MIN_SAMPLE_VALUE          0x0154
381
#define TAG_S_MAX_SAMPLE_VALUE          0x0155
382
#define TAG_TRANSFER_RANGE              0x0156
383
#define TAG_JPEG_TABLES                 0x015B
384
#define TAG_JPEG_PROC                   0x0200
385
683
#define TAG_JPEG_INTERCHANGE_FORMAT     0x0201
386
567
#define TAG_JPEG_INTERCHANGE_FORMAT_LEN 0x0202
387
#define TAG_JPEG_RESTART_INTERVAL       0x0203
388
#define TAG_JPEG_LOSSLESS_PREDICTOR     0x0205
389
#define TAG_JPEG_POINT_TRANSFORMS       0x0206
390
#define TAG_JPEG_Q_TABLES               0x0207
391
#define TAG_JPEG_DC_TABLES              0x0208
392
#define TAG_JPEG_AC_TABLES              0x0209
393
#define TAG_YCC_COEFFICIENTS            0x0211
394
#define TAG_YCC_SUB_SAMPLING            0x0212
395
#define TAG_YCC_POSITIONING             0x0213
396
#define TAG_REFERENCE_BLACK_WHITE       0x0214
397
/* 0x0301 - 0x0302 */
398
/* 0x0320 */
399
/* 0x0343 */
400
/* 0x5001 - 0x501B */
401
/* 0x5021 - 0x503B */
402
/* 0x5090 - 0x5091 */
403
/* 0x5100 - 0x5101 */
404
/* 0x5110 - 0x5113 */
405
/* 0x80E3 - 0x80E6 */
406
/* 0x828d - 0x828F */
407
1.49k
#define TAG_COPYRIGHT                   0x8298
408
49
#define TAG_EXPOSURETIME                0x829A
409
519
#define TAG_FNUMBER                     0x829D
410
335k
#define TAG_EXIF_IFD_POINTER            0x8769
411
#define TAG_ICC_PROFILE                 0x8773
412
#define TAG_EXPOSURE_PROGRAM            0x8822
413
#define TAG_SPECTRAL_SENSITIVITY        0x8824
414
272k
#define TAG_GPS_IFD_POINTER             0x8825
415
#define TAG_ISOSPEED                    0x8827
416
#define TAG_OPTOELECTRIC_CONVERSION_F   0x8828
417
/* 0x8829 - 0x882b */
418
#define TAG_EXIFVERSION                 0x9000
419
#define TAG_DATE_TIME_ORIGINAL          0x9003
420
#define TAG_DATE_TIME_DIGITIZED         0x9004
421
#define TAG_OFFSET_TIME                 0x9010
422
#define TAG_OFFSET_TIME_ORIGINAL        0x9011
423
#define TAG_OFFSET_TIME_DIGITIZED       0x9012
424
#define TAG_COMPONENT_CONFIG            0x9101
425
#define TAG_COMPRESSED_BITS_PER_PIXEL   0x9102
426
407
#define TAG_SHUTTERSPEED                0x9201
427
701
#define TAG_APERTURE                    0x9202
428
#define TAG_BRIGHTNESS_VALUE            0x9203
429
#define TAG_EXPOSURE_BIAS_VALUE         0x9204
430
901
#define TAG_MAX_APERTURE                0x9205
431
448
#define TAG_SUBJECT_DISTANCE            0x9206
432
#define TAG_METRIC_MODULE               0x9207
433
#define TAG_LIGHT_SOURCE                0x9208
434
#define TAG_FLASH                       0x9209
435
#define TAG_FOCAL_LENGTH                0x920A
436
/* 0x920B - 0x920D */
437
/* 0x9211 - 0x9216 */
438
#define TAG_SUBJECT_AREA                0x9214
439
37.6k
#define TAG_MAKER_NOTE                  0x927C
440
1.03k
#define TAG_USERCOMMENT                 0x9286
441
#define TAG_SUB_SEC_TIME                0x9290
442
#define TAG_SUB_SEC_TIME_ORIGINAL       0x9291
443
#define TAG_SUB_SEC_TIME_DIGITIZED      0x9292
444
/* 0x923F */
445
/* 0x935C */
446
609
#define TAG_XP_TITLE                    0x9C9B
447
996
#define TAG_XP_COMMENTS                 0x9C9C
448
1.80k
#define TAG_XP_AUTHOR                   0x9C9D
449
2.32k
#define TAG_XP_KEYWORDS                 0x9C9E
450
2.32k
#define TAG_XP_SUBJECT                  0x9C9F
451
#define TAG_FLASH_PIX_VERSION           0xA000
452
#define TAG_COLOR_SPACE                 0xA001
453
62.9k
#define TAG_COMP_IMAGE_WIDTH            0xA002 /* compressed images only */
454
5.94k
#define TAG_COMP_IMAGE_HEIGHT           0xA003
455
#define TAG_RELATED_SOUND_FILE          0xA004
456
269k
#define TAG_INTEROP_IFD_POINTER         0xA005 /* IFD pointer */
457
#define TAG_FLASH_ENERGY                0xA20B
458
#define TAG_SPATIAL_FREQUENCY_RESPONSE  0xA20C
459
68
#define TAG_FOCALPLANE_X_RES            0xA20E
460
#define TAG_FOCALPLANE_Y_RES            0xA20F
461
187
#define TAG_FOCALPLANE_RESOLUTION_UNIT  0xA210
462
#define TAG_SUBJECT_LOCATION            0xA214
463
#define TAG_EXPOSURE_INDEX              0xA215
464
#define TAG_SENSING_METHOD              0xA217
465
#define TAG_FILE_SOURCE                 0xA300
466
#define TAG_SCENE_TYPE                  0xA301
467
#define TAG_CFA_PATTERN                 0xA302
468
#define TAG_CUSTOM_RENDERED             0xA401
469
#define TAG_EXPOSURE_MODE               0xA402
470
#define TAG_WHITE_BALANCE               0xA403
471
#define TAG_DIGITAL_ZOOM_RATIO          0xA404
472
#define TAG_FOCAL_LENGTH_IN_35_MM_FILM  0xA405
473
#define TAG_SCENE_CAPTURE_TYPE          0xA406
474
#define TAG_GAIN_CONTROL                0xA407
475
#define TAG_CONTRAST                    0xA408
476
#define TAG_SATURATION                  0xA409
477
#define TAG_SHARPNESS                   0xA40A
478
#define TAG_DEVICE_SETTING_DESCRIPTION  0xA40B
479
#define TAG_SUBJECT_DISTANCE_RANGE      0xA40C
480
#define TAG_IMAGE_UNIQUE_ID             0xA420
481
482
/* Olympus specific tags */
483
#define TAG_OLYMPUS_SPECIALMODE         0x0200
484
#define TAG_OLYMPUS_JPEGQUAL            0x0201
485
#define TAG_OLYMPUS_MACRO               0x0202
486
#define TAG_OLYMPUS_DIGIZOOM            0x0204
487
#define TAG_OLYMPUS_SOFTWARERELEASE     0x0207
488
#define TAG_OLYMPUS_PICTINFO            0x0208
489
#define TAG_OLYMPUS_CAMERAID            0x0209
490
/* end Olympus specific tags */
491
492
/* Internal */
493
8.87k
#define TAG_NONE                    -1 /* note that -1 <> 0xFFFF */
494
434k
#define TAG_COMPUTED_VALUE          -2
495
670
#define TAG_END_OF_LIST                 0xFFFD
496
497
/* Values for TAG_PHOTOMETRIC_INTERPRETATION */
498
512
#define PMI_BLACK_IS_ZERO       0
499
512
#define PMI_WHITE_IS_ZERO       1
500
1
#define PMI_RGB               2
501
307
#define PMI_PALETTE_COLOR       3
502
512
#define PMI_TRANSPARENCY_MASK   4
503
307
#define PMI_SEPARATED           5
504
307
#define PMI_YCBCR               6
505
351
#define PMI_CIELAB              8
506
507
/* }}} */
508
509
/* {{{ TabTable[] */
510
typedef const struct {
511
  unsigned short Tag;
512
  char *Desc;
513
} tag_info_type;
514
515
typedef tag_info_type  tag_info_array[];
516
typedef tag_info_type  *tag_table_type;
517
518
#define TAG_TABLE_END \
519
  {TAG_NONE,           "No tag value"},\
520
  {TAG_COMPUTED_VALUE, "Computed value"},\
521
  {TAG_END_OF_LIST,    ""}  /* Important for exif_get_tagname() IF value != "" function result is != false */
522
523
static tag_info_array tag_table_IFD = {
524
  { 0x000B, "ACDComment"},
525
  { 0x00FE, "NewSubFile"}, /* better name it 'ImageType' ? */
526
  { 0x00FF, "SubFile"},
527
  { 0x0100, "ImageWidth"},
528
  { 0x0101, "ImageLength"},
529
  { 0x0102, "BitsPerSample"},
530
  { 0x0103, "Compression"},
531
  { 0x0106, "PhotometricInterpretation"},
532
  { 0x010A, "FillOrder"},
533
  { 0x010D, "DocumentName"},
534
  { 0x010E, "ImageDescription"},
535
  { 0x010F, "Make"},
536
  { 0x0110, "Model"},
537
  { 0x0111, "StripOffsets"},
538
  { 0x0112, "Orientation"},
539
  { 0x0115, "SamplesPerPixel"},
540
  { 0x0116, "RowsPerStrip"},
541
  { 0x0117, "StripByteCounts"},
542
  { 0x0118, "MinSampleValue"},
543
  { 0x0119, "MaxSampleValue"},
544
  { 0x011A, "XResolution"},
545
  { 0x011B, "YResolution"},
546
  { 0x011C, "PlanarConfiguration"},
547
  { 0x011D, "PageName"},
548
  { 0x011E, "XPosition"},
549
  { 0x011F, "YPosition"},
550
  { 0x0120, "FreeOffsets"},
551
  { 0x0121, "FreeByteCounts"},
552
  { 0x0122, "GrayResponseUnit"},
553
  { 0x0123, "GrayResponseCurve"},
554
  { 0x0124, "T4Options"},
555
  { 0x0125, "T6Options"},
556
  { 0x0128, "ResolutionUnit"},
557
  { 0x0129, "PageNumber"},
558
  { 0x012D, "TransferFunction"},
559
  { 0x0131, "Software"},
560
  { 0x0132, "DateTime"},
561
  { 0x013B, "Artist"},
562
  { 0x013C, "HostComputer"},
563
  { 0x013D, "Predictor"},
564
  { 0x013E, "WhitePoint"},
565
  { 0x013F, "PrimaryChromaticities"},
566
  { 0x0140, "ColorMap"},
567
  { 0x0141, "HalfToneHints"},
568
  { 0x0142, "TileWidth"},
569
  { 0x0143, "TileLength"},
570
  { 0x0144, "TileOffsets"},
571
  { 0x0145, "TileByteCounts"},
572
  { 0x014A, "SubIFD"},
573
  { 0x014C, "InkSet"},
574
  { 0x014D, "InkNames"},
575
  { 0x014E, "NumberOfInks"},
576
  { 0x0150, "DotRange"},
577
  { 0x0151, "TargetPrinter"},
578
  { 0x0152, "ExtraSample"},
579
  { 0x0153, "SampleFormat"},
580
  { 0x0154, "SMinSampleValue"},
581
  { 0x0155, "SMaxSampleValue"},
582
  { 0x0156, "TransferRange"},
583
  { 0x0157, "ClipPath"},
584
  { 0x0158, "XClipPathUnits"},
585
  { 0x0159, "YClipPathUnits"},
586
  { 0x015A, "Indexed"},
587
  { 0x015B, "JPEGTables"},
588
  { 0x015F, "OPIProxy"},
589
  { 0x0200, "JPEGProc"},
590
  { 0x0201, "JPEGInterchangeFormat"},
591
  { 0x0202, "JPEGInterchangeFormatLength"},
592
  { 0x0203, "JPEGRestartInterval"},
593
  { 0x0205, "JPEGLosslessPredictors"},
594
  { 0x0206, "JPEGPointTransforms"},
595
  { 0x0207, "JPEGQTables"},
596
  { 0x0208, "JPEGDCTables"},
597
  { 0x0209, "JPEGACTables"},
598
  { 0x0211, "YCbCrCoefficients"},
599
  { 0x0212, "YCbCrSubSampling"},
600
  { 0x0213, "YCbCrPositioning"},
601
  { 0x0214, "ReferenceBlackWhite"},
602
  { 0x02BC, "ExtensibleMetadataPlatform"}, /* XAP: Extensible Authoring Publishing, obsoleted by XMP: Extensible Metadata Platform */
603
  { 0x0301, "Gamma"},
604
  { 0x0302, "ICCProfileDescriptor"},
605
  { 0x0303, "SRGBRenderingIntent"},
606
  { 0x0320, "ImageTitle"},
607
  { 0x5001, "ResolutionXUnit"},
608
  { 0x5002, "ResolutionYUnit"},
609
  { 0x5003, "ResolutionXLengthUnit"},
610
  { 0x5004, "ResolutionYLengthUnit"},
611
  { 0x5005, "PrintFlags"},
612
  { 0x5006, "PrintFlagsVersion"},
613
  { 0x5007, "PrintFlagsCrop"},
614
  { 0x5008, "PrintFlagsBleedWidth"},
615
  { 0x5009, "PrintFlagsBleedWidthScale"},
616
  { 0x500A, "HalftoneLPI"},
617
  { 0x500B, "HalftoneLPIUnit"},
618
  { 0x500C, "HalftoneDegree"},
619
  { 0x500D, "HalftoneShape"},
620
  { 0x500E, "HalftoneMisc"},
621
  { 0x500F, "HalftoneScreen"},
622
  { 0x5010, "JPEGQuality"},
623
  { 0x5011, "GridSize"},
624
  { 0x5012, "ThumbnailFormat"},
625
  { 0x5013, "ThumbnailWidth"},
626
  { 0x5014, "ThumbnailHeight"},
627
  { 0x5015, "ThumbnailColorDepth"},
628
  { 0x5016, "ThumbnailPlanes"},
629
  { 0x5017, "ThumbnailRawBytes"},
630
  { 0x5018, "ThumbnailSize"},
631
  { 0x5019, "ThumbnailCompressedSize"},
632
  { 0x501A, "ColorTransferFunction"},
633
  { 0x501B, "ThumbnailData"},
634
  { 0x5020, "ThumbnailImageWidth"},
635
  { 0x5021, "ThumbnailImageHeight"},
636
  { 0x5022, "ThumbnailBitsPerSample"},
637
  { 0x5023, "ThumbnailCompression"},
638
  { 0x5024, "ThumbnailPhotometricInterp"},
639
  { 0x5025, "ThumbnailImageDescription"},
640
  { 0x5026, "ThumbnailEquipMake"},
641
  { 0x5027, "ThumbnailEquipModel"},
642
  { 0x5028, "ThumbnailStripOffsets"},
643
  { 0x5029, "ThumbnailOrientation"},
644
  { 0x502A, "ThumbnailSamplesPerPixel"},
645
  { 0x502B, "ThumbnailRowsPerStrip"},
646
  { 0x502C, "ThumbnailStripBytesCount"},
647
  { 0x502D, "ThumbnailResolutionX"},
648
  { 0x502E, "ThumbnailResolutionY"},
649
  { 0x502F, "ThumbnailPlanarConfig"},
650
  { 0x5030, "ThumbnailResolutionUnit"},
651
  { 0x5031, "ThumbnailTransferFunction"},
652
  { 0x5032, "ThumbnailSoftwareUsed"},
653
  { 0x5033, "ThumbnailDateTime"},
654
  { 0x5034, "ThumbnailArtist"},
655
  { 0x5035, "ThumbnailWhitePoint"},
656
  { 0x5036, "ThumbnailPrimaryChromaticities"},
657
  { 0x5037, "ThumbnailYCbCrCoefficients"},
658
  { 0x5038, "ThumbnailYCbCrSubsampling"},
659
  { 0x5039, "ThumbnailYCbCrPositioning"},
660
  { 0x503A, "ThumbnailRefBlackWhite"},
661
  { 0x503B, "ThumbnailCopyRight"},
662
  { 0x5090, "LuminanceTable"},
663
  { 0x5091, "ChrominanceTable"},
664
  { 0x5100, "FrameDelay"},
665
  { 0x5101, "LoopCount"},
666
  { 0x5110, "PixelUnit"},
667
  { 0x5111, "PixelPerUnitX"},
668
  { 0x5112, "PixelPerUnitY"},
669
  { 0x5113, "PaletteHistogram"},
670
  { 0x1000, "RelatedImageFileFormat"},
671
  { 0x800D, "ImageID"},
672
  { 0x80E3, "Matteing"},   /* obsoleted by ExtraSamples */
673
  { 0x80E4, "DataType"},   /* obsoleted by SampleFormat */
674
  { 0x80E5, "ImageDepth"},
675
  { 0x80E6, "TileDepth"},
676
  { 0x828D, "CFARepeatPatternDim"},
677
  { 0x828E, "CFAPattern"},
678
  { 0x828F, "BatteryLevel"},
679
  { 0x8298, "Copyright"},
680
  { 0x829A, "ExposureTime"},
681
  { 0x829D, "FNumber"},
682
  { 0x83BB, "IPTC/NAA"},
683
  { 0x84E3, "IT8RasterPadding"},
684
  { 0x84E5, "IT8ColorTable"},
685
  { 0x8649, "ImageResourceInformation"}, /* PhotoShop */
686
  { 0x8769, "Exif_IFD_Pointer"},
687
  { 0x8773, "ICC_Profile"},
688
  { 0x8822, "ExposureProgram"},
689
  { 0x8824, "SpectralSensitivity"},
690
  { 0x8825, "GPS_IFD_Pointer"},
691
  { 0x8827, "ISOSpeedRatings"},
692
  { 0x8828, "OECF"},
693
  { 0x9000, "ExifVersion"},
694
  { 0x9003, "DateTimeOriginal"},
695
  { 0x9004, "DateTimeDigitized"},
696
  { 0x9010, "OffsetTime"},
697
  { 0x9011, "OffsetTimeOriginal"},
698
  { 0x9012, "OffsetTimeDigitized"},
699
  { 0x9101, "ComponentsConfiguration"},
700
  { 0x9102, "CompressedBitsPerPixel"},
701
  { 0x9201, "ShutterSpeedValue"},
702
  { 0x9202, "ApertureValue"},
703
  { 0x9203, "BrightnessValue"},
704
  { 0x9204, "ExposureBiasValue"},
705
  { 0x9205, "MaxApertureValue"},
706
  { 0x9206, "SubjectDistance"},
707
  { 0x9207, "MeteringMode"},
708
  { 0x9208, "LightSource"},
709
  { 0x9209, "Flash"},
710
  { 0x920A, "FocalLength"},
711
  { 0x920B, "FlashEnergy"},                 /* 0xA20B  in JPEG   */
712
  { 0x920C, "SpatialFrequencyResponse"},    /* 0xA20C    -  -    */
713
  { 0x920D, "Noise"},
714
  { 0x920E, "FocalPlaneXResolution"},       /* 0xA20E    -  -    */
715
  { 0x920F, "FocalPlaneYResolution"},       /* 0xA20F    -  -    */
716
  { 0x9210, "FocalPlaneResolutionUnit"},    /* 0xA210    -  -    */
717
  { 0x9211, "ImageNumber"},
718
  { 0x9212, "SecurityClassification"},
719
  { 0x9213, "ImageHistory"},
720
  { 0x9214, "SubjectLocation"},             /* 0xA214    -  -    */
721
  { 0x9215, "ExposureIndex"},               /* 0xA215    -  -    */
722
  { 0x9216, "TIFF/EPStandardID"},
723
  { 0x9217, "SensingMethod"},               /* 0xA217    -  -    */
724
  { 0x923F, "StoNits"},
725
  { 0x927C, "MakerNote"},
726
  { 0x9286, "UserComment"},
727
  { 0x9290, "SubSecTime"},
728
  { 0x9291, "SubSecTimeOriginal"},
729
  { 0x9292, "SubSecTimeDigitized"},
730
  { 0x935C, "ImageSourceData"},             /* "Adobe Photoshop Document Data Block": 8BIM... */
731
  { 0x9c9b, "Title" },                      /* Win XP specific, Unicode  */
732
  { 0x9c9c, "Comments" },                   /* Win XP specific, Unicode  */
733
  { 0x9c9d, "Author" },                     /* Win XP specific, Unicode  */
734
  { 0x9c9e, "Keywords" },                   /* Win XP specific, Unicode  */
735
  { 0x9c9f, "Subject" },                    /* Win XP specific, Unicode, not to be confused with SubjectDistance and SubjectLocation */
736
  { 0xA000, "FlashPixVersion"},
737
  { 0xA001, "ColorSpace"},
738
  { 0xA002, "ExifImageWidth"},
739
  { 0xA003, "ExifImageLength"},
740
  { 0xA004, "RelatedSoundFile"},
741
  { 0xA005, "InteroperabilityOffset"},
742
  { 0xA20B, "FlashEnergy"},                 /* 0x920B in TIFF/EP */
743
  { 0xA20C, "SpatialFrequencyResponse"},    /* 0x920C    -  -    */
744
  { 0xA20D, "Noise"},
745
  { 0xA20E, "FocalPlaneXResolution"},     /* 0x920E    -  -    */
746
  { 0xA20F, "FocalPlaneYResolution"},       /* 0x920F    -  -    */
747
  { 0xA210, "FocalPlaneResolutionUnit"},    /* 0x9210    -  -    */
748
  { 0xA211, "ImageNumber"},
749
  { 0xA212, "SecurityClassification"},
750
  { 0xA213, "ImageHistory"},
751
  { 0xA214, "SubjectLocation"},             /* 0x9214    -  -    */
752
  { 0xA215, "ExposureIndex"},               /* 0x9215    -  -    */
753
  { 0xA216, "TIFF/EPStandardID"},
754
  { 0xA217, "SensingMethod"},               /* 0x9217    -  -    */
755
  { 0xA300, "FileSource"},
756
  { 0xA301, "SceneType"},
757
  { 0xA302, "CFAPattern"},
758
  { 0xA401, "CustomRendered"},
759
  { 0xA402, "ExposureMode"},
760
  { 0xA403, "WhiteBalance"},
761
  { 0xA404, "DigitalZoomRatio"},
762
  { 0xA405, "FocalLengthIn35mmFilm"},
763
  { 0xA406, "SceneCaptureType"},
764
  { 0xA407, "GainControl"},
765
  { 0xA408, "Contrast"},
766
  { 0xA409, "Saturation"},
767
  { 0xA40A, "Sharpness"},
768
  { 0xA40B, "DeviceSettingDescription"},
769
  { 0xA40C, "SubjectDistanceRange"},
770
  { 0xA420, "ImageUniqueID"},
771
  TAG_TABLE_END
772
} ;
773
774
static tag_info_array tag_table_GPS = {
775
  { 0x0000, "GPSVersion"},
776
  { 0x0001, "GPSLatitudeRef"},
777
  { 0x0002, "GPSLatitude"},
778
  { 0x0003, "GPSLongitudeRef"},
779
  { 0x0004, "GPSLongitude"},
780
  { 0x0005, "GPSAltitudeRef"},
781
  { 0x0006, "GPSAltitude"},
782
  { 0x0007, "GPSTimeStamp"},
783
  { 0x0008, "GPSSatellites"},
784
  { 0x0009, "GPSStatus"},
785
  { 0x000A, "GPSMeasureMode"},
786
  { 0x000B, "GPSDOP"},
787
  { 0x000C, "GPSSpeedRef"},
788
  { 0x000D, "GPSSpeed"},
789
  { 0x000E, "GPSTrackRef"},
790
  { 0x000F, "GPSTrack"},
791
  { 0x0010, "GPSImgDirectionRef"},
792
  { 0x0011, "GPSImgDirection"},
793
  { 0x0012, "GPSMapDatum"},
794
  { 0x0013, "GPSDestLatitudeRef"},
795
  { 0x0014, "GPSDestLatitude"},
796
  { 0x0015, "GPSDestLongitudeRef"},
797
  { 0x0016, "GPSDestLongitude"},
798
  { 0x0017, "GPSDestBearingRef"},
799
  { 0x0018, "GPSDestBearing"},
800
  { 0x0019, "GPSDestDistanceRef"},
801
  { 0x001A, "GPSDestDistance"},
802
  { 0x001B, "GPSProcessingMode"},
803
  { 0x001C, "GPSAreaInformation"},
804
  { 0x001D, "GPSDateStamp"},
805
  { 0x001E, "GPSDifferential"},
806
  TAG_TABLE_END
807
};
808
809
static tag_info_array tag_table_IOP = {
810
  { 0x0001, "InterOperabilityIndex"}, /* should be 'R98' or 'THM' */
811
  { 0x0002, "InterOperabilityVersion"},
812
  { 0x1000, "RelatedFileFormat"},
813
  { 0x1001, "RelatedImageWidth"},
814
  { 0x1002, "RelatedImageHeight"},
815
  TAG_TABLE_END
816
};
817
818
static tag_info_array tag_table_VND_CANON = {
819
  { 0x0001, "ModeArray"}, /* guess */
820
  { 0x0004, "ImageInfo"}, /* guess */
821
  { 0x0006, "ImageType"},
822
  { 0x0007, "FirmwareVersion"},
823
  { 0x0008, "ImageNumber"},
824
  { 0x0009, "OwnerName"},
825
  { 0x000C, "Camera"},
826
  { 0x000F, "CustomFunctions"},
827
  TAG_TABLE_END
828
};
829
830
static tag_info_array tag_table_VND_CASIO = {
831
  { 0x0001, "RecordingMode"},
832
  { 0x0002, "Quality"},
833
  { 0x0003, "FocusingMode"},
834
  { 0x0004, "FlashMode"},
835
  { 0x0005, "FlashIntensity"},
836
  { 0x0006, "ObjectDistance"},
837
  { 0x0007, "WhiteBalance"},
838
  { 0x000A, "DigitalZoom"},
839
  { 0x000B, "Sharpness"},
840
  { 0x000C, "Contrast"},
841
  { 0x000D, "Saturation"},
842
  { 0x0014, "CCDSensitivity"},
843
  TAG_TABLE_END
844
};
845
846
static tag_info_array tag_table_VND_FUJI = {
847
  { 0x0000, "Version"},
848
  { 0x1000, "Quality"},
849
  { 0x1001, "Sharpness"},
850
  { 0x1002, "WhiteBalance"},
851
  { 0x1003, "Color"},
852
  { 0x1004, "Tone"},
853
  { 0x1010, "FlashMode"},
854
  { 0x1011, "FlashStrength"},
855
  { 0x1020, "Macro"},
856
  { 0x1021, "FocusMode"},
857
  { 0x1030, "SlowSync"},
858
  { 0x1031, "PictureMode"},
859
  { 0x1100, "ContTake"},
860
  { 0x1300, "BlurWarning"},
861
  { 0x1301, "FocusWarning"},
862
  { 0x1302, "AEWarning "},
863
  TAG_TABLE_END
864
};
865
866
static tag_info_array tag_table_VND_NIKON = {
867
  { 0x0003, "Quality"},
868
  { 0x0004, "ColorMode"},
869
  { 0x0005, "ImageAdjustment"},
870
  { 0x0006, "CCDSensitivity"},
871
  { 0x0007, "WhiteBalance"},
872
  { 0x0008, "Focus"},
873
  { 0x000a, "DigitalZoom"},
874
  { 0x000b, "Converter"},
875
  TAG_TABLE_END
876
};
877
878
static tag_info_array tag_table_VND_NIKON_990 = {
879
  { 0x0001, "Version"},
880
  { 0x0002, "ISOSetting"},
881
  { 0x0003, "ColorMode"},
882
  { 0x0004, "Quality"},
883
  { 0x0005, "WhiteBalance"},
884
  { 0x0006, "ImageSharpening"},
885
  { 0x0007, "FocusMode"},
886
  { 0x0008, "FlashSetting"},
887
  { 0x000F, "ISOSelection"},
888
  { 0x0080, "ImageAdjustment"},
889
  { 0x0082, "AuxiliaryLens"},
890
  { 0x0085, "ManualFocusDistance"},
891
  { 0x0086, "DigitalZoom"},
892
  { 0x0088, "AFFocusPosition"},
893
  { 0x0010, "DataDump"},
894
  TAG_TABLE_END
895
};
896
897
static tag_info_array tag_table_VND_OLYMPUS = {
898
  { 0x0200, "SpecialMode"},
899
  { 0x0201, "JPEGQuality"},
900
  { 0x0202, "Macro"},
901
  { 0x0204, "DigitalZoom"},
902
  { 0x0207, "SoftwareRelease"},
903
  { 0x0208, "PictureInfo"},
904
  { 0x0209, "CameraId"},
905
  { 0x0F00, "DataDump"},
906
  TAG_TABLE_END
907
};
908
909
static tag_info_array tag_table_VND_SAMSUNG = {
910
  { 0x0001, "Version"},
911
  { 0x0021, "PictureWizard"},
912
  { 0x0030, "LocalLocationName"},
913
  { 0x0031, "LocationName"},
914
  { 0x0035, "Preview"},
915
  { 0x0043, "CameraTemperature"},
916
  { 0xa001, "FirmwareName"},
917
  { 0xa003, "LensType"},
918
  { 0xa004, "LensFirmware"},
919
  { 0xa010, "SensorAreas"},
920
  { 0xa011, "ColorSpace"},
921
  { 0xa012, "SmartRange"},
922
  { 0xa013, "ExposureBiasValue"},
923
  { 0xa014, "ISO"},
924
  { 0xa018, "ExposureTime"},
925
  { 0xa019, "FNumber"},
926
  { 0xa01a, "FocalLengthIn35mmFormat"},
927
  { 0xa020, "EncryptionKey"},
928
  { 0xa021, "WB_RGGBLevelsUncorrected"},
929
  { 0xa022, "WB_RGGBLevelsAuto"},
930
  { 0xa023, "WB_RGGBLevelsIlluminator1"},
931
  { 0xa024, "WB_RGGBLevelsIlluminator2"},
932
  { 0xa028, "WB_RGGBLevelsBlack"},
933
  { 0xa030, "ColorMatrix"},
934
  { 0xa031, "ColorMatrixSRGB"},
935
  { 0xa032, "ColorMatrixAdobeRGB"},
936
  { 0xa040, "ToneCurve1"},
937
  { 0xa041, "ToneCurve2"},
938
  { 0xa042, "ToneCurve3"},
939
  { 0xa043, "ToneCurve4"},
940
  TAG_TABLE_END
941
};
942
943
static tag_info_array tag_table_VND_PANASONIC = {
944
  { 0x0001, "Quality"},
945
  { 0x0002, "FirmwareVersion"},
946
  { 0x0003, "WhiteBalance"},
947
  { 0x0007, "FocusMode"},
948
  { 0x000f, "AFMode"},
949
  { 0x001a, "ImageStabilization"},
950
  { 0x001c, "Macro"},
951
  { 0x001f, "ShootingMode"},
952
  { 0x0020, "Audio"},
953
  { 0x0021, "DataDump"},
954
  { 0x0023, "WhiteBalanceBias"},
955
  { 0x0024, "FlashBias"},
956
  { 0x0025, "InternalSerialNumber"},
957
  { 0x0026, "ExifVersion"},
958
  { 0x0028, "ColorEffect"},
959
  { 0x0029, "TimeSincePowerOn"},
960
  { 0x002a, "BurstMode"},
961
  { 0x002b, "SequenceNumber"},
962
  { 0x002c, "Contrast"},
963
  { 0x002d, "NoiseReduction"},
964
  { 0x002e, "SelfTimer"},
965
  { 0x0030, "Rotation"},
966
  { 0x0031, "AFAssistLamp"},
967
  { 0x0032, "ColorMode"},
968
  { 0x0033, "BabyAge1"},
969
  { 0x0034, "OpticalZoomMode"},
970
  { 0x0035, "ConversionLens"},
971
  { 0x0036, "TravelDay"},
972
  { 0x0039, "Contrast"},
973
  { 0x003a, "WorldTimeLocation"},
974
  { 0x003b, "TextStamp1"},
975
  { 0x003c, "ProgramISO"},
976
  { 0x003d, "AdvancedSceneType"},
977
  { 0x003e, "TextStamp2"},
978
  { 0x003f, "FacesDetected"},
979
  { 0x0040, "Saturation"},
980
  { 0x0041, "Sharpness"},
981
  { 0x0042, "FilmMode"},
982
  { 0x0044, "ColorTempKelvin"},
983
  { 0x0045, "BracketSettings"},
984
  { 0x0046, "WBAdjustAB"},
985
  { 0x0047, "WBAdjustGM"},
986
  { 0x0048, "FlashCurtain"},
987
  { 0x0049, "LongShutterNoiseReduction"},
988
  { 0x004b, "ImageWidth"},
989
  { 0x004c, "ImageHeight"},
990
  { 0x004d, "AFPointPosition"},
991
  { 0x004e, "FaceDetInfo"},
992
  { 0x0051, "LensType"},
993
  { 0x0052, "LensSerialNumber"},
994
  { 0x0053, "AccessoryType"},
995
  { 0x0054, "AccessorySerialNumber"},
996
  { 0x0059, "Transform1"},
997
  { 0x005d, "IntelligentExposure"},
998
  { 0x0060, "LensFirmwareVersion"},
999
  { 0x0061, "FaceRecInfo"},
1000
  { 0x0062, "FlashWarning"},
1001
  { 0x0065, "Title"},
1002
  { 0x0066, "BabyName"},
1003
  { 0x0067, "Location"},
1004
  { 0x0069, "Country"},
1005
  { 0x006b, "State"},
1006
  { 0x006d, "City"},
1007
  { 0x006f, "Landmark"},
1008
  { 0x0070, "IntelligentResolution"},
1009
  { 0x0077, "BurstSheed"},
1010
  { 0x0079, "IntelligentDRange"},
1011
  { 0x007c, "ClearRetouch"},
1012
  { 0x0080, "City2"},
1013
  { 0x0086, "ManometerPressure"},
1014
  { 0x0089, "PhotoStyle"},
1015
  { 0x008a, "ShadingCompensation"},
1016
  { 0x008c, "AccelerometerZ"},
1017
  { 0x008d, "AccelerometerX"},
1018
  { 0x008e, "AccelerometerY"},
1019
  { 0x008f, "CameraOrientation"},
1020
  { 0x0090, "RollAngle"},
1021
  { 0x0091, "PitchAngle"},
1022
  { 0x0093, "SweepPanoramaDirection"},
1023
  { 0x0094, "PanoramaFieldOfView"},
1024
  { 0x0096, "TimerRecording"},
1025
  { 0x009d, "InternalNDFilter"},
1026
  { 0x009e, "HDR"},
1027
  { 0x009f, "ShutterType"},
1028
  { 0x00a3, "ClearRetouchValue"},
1029
  { 0x00ab, "TouchAE"},
1030
  { 0x0e00, "PrintIM"},
1031
  { 0x8000, "MakerNoteVersion"},
1032
  { 0x8001, "SceneMode"},
1033
  { 0x8004, "WBRedLevel"},
1034
  { 0x8005, "WBGreenLevel"},
1035
  { 0x8006, "WBBlueLevel"},
1036
  { 0x8007, "FlashFired"},
1037
  { 0x8008, "TextStamp3"},
1038
  { 0x8009, "TextStamp4"},
1039
  { 0x8010, "BabyAge2"},
1040
  { 0x8012, "Transform2"},
1041
  TAG_TABLE_END
1042
};
1043
1044
static tag_info_array tag_table_VND_DJI = {
1045
  { 0x0001, "Make"},
1046
  { 0x0003, "SpeedX"},
1047
  { 0x0004, "SpeedY"},
1048
  { 0x0005, "SpeedZ"},
1049
  { 0x0006, "Pitch"},
1050
  { 0x0007, "Yaw"},
1051
  { 0x0008, "Roll"},
1052
  { 0x0009, "CameraPitch"},
1053
  { 0x000a, "CameraYaw"},
1054
  { 0x000b, "CameraRoll"},
1055
  TAG_TABLE_END
1056
};
1057
1058
static tag_info_array tag_table_VND_SONY = {
1059
  { 0x0102, "Quality"},
1060
  { 0x0104, "FlashExposureComp"},
1061
  { 0x0105, "Teleconverter"},
1062
  { 0x0112, "WhiteBalanceFineTune"},
1063
  { 0x0114, "CameraSettings"},
1064
  { 0x0115, "WhiteBalance"},
1065
  { 0x0116, "ExtraInfo"},
1066
  { 0x0e00, "PrintIM"},
1067
  { 0x1000, "MultiBurstMode"},
1068
  { 0x1001, "MultiBurstImageWidth"},
1069
  { 0x1002, "MultiBurstImageHeight"},
1070
  { 0x1003, "Panorama"},
1071
  { 0x2001, "PreviewImage"},
1072
  { 0x2002, "Rating"},
1073
  { 0x2004, "Contrast"},
1074
  { 0x2005, "Saturation"},
1075
  { 0x2006, "Sharpness"},
1076
  { 0x2007, "Brightness"},
1077
  { 0x2008, "LongExposureNoiseReduction"},
1078
  { 0x2009, "HighISONoiseReduction"},
1079
  { 0x200a, "AutoHDR"},
1080
  { 0x3000, "ShotInfo"},
1081
  { 0xb000, "FileFormat"},
1082
  { 0xb001, "SonyModelID"},
1083
  { 0xb020, "ColorReproduction"},
1084
  { 0xb021, "ColorTemperature"},
1085
  { 0xb022, "ColorCompensationFilter"},
1086
  { 0xb023, "SceneMode"},
1087
  { 0xb024, "ZoneMatching"},
1088
  { 0xb025, "DynamicRangeOptimizer"},
1089
  { 0xb026, "ImageStabilization"},
1090
  { 0xb027, "LensID"},
1091
  { 0xb028, "MinoltaMakerNote"},
1092
  { 0xb029, "ColorMode"},
1093
  { 0xb02b, "FullImageSize"},
1094
  { 0xb02c, "PreviewImageSize"},
1095
  { 0xb040, "Macro"},
1096
  { 0xb041, "ExposureMode"},
1097
  { 0xb042, "FocusMode"},
1098
  { 0xb043, "AFMode"},
1099
  { 0xb044, "AFIlluminator"},
1100
  { 0xb047, "JPEGQuality"},
1101
  { 0xb048, "FlashLevel"},
1102
  { 0xb049, "ReleaseMode"},
1103
  { 0xb04a, "SequenceNumber"},
1104
  { 0xb04b, "AntiBlur"},
1105
  { 0xb04e, "FocusMode"},
1106
  { 0xb04f, "DynamicRangeOptimizer"},
1107
  { 0xb050, "HighISONoiseReduction2"},
1108
  { 0xb052, "IntelligentAuto"},
1109
  { 0xb054, "WhiteBalance2"},
1110
  TAG_TABLE_END
1111
};
1112
1113
static tag_info_array tag_table_VND_PENTAX = {
1114
  { 0x0000, "Version"},
1115
  { 0x0001, "Mode"},
1116
  { 0x0002, "PreviewResolution"},
1117
  { 0x0003, "PreviewLength"},
1118
  { 0x0004, "PreviewOffset"},
1119
  { 0x0005, "ModelID"},
1120
  { 0x0006, "Date"},
1121
  { 0x0007, "Time"},
1122
  { 0x0008, "Quality"},
1123
  { 0x0009, "Size"},
1124
  { 0x000c, "Flash"},
1125
  { 0x000d, "Focus"},
1126
  { 0x000e, "AFPoint"},
1127
  { 0x000f, "AFPointInFocus"},
1128
  { 0x0012, "ExposureTime"},
1129
  { 0x0013, "FNumber"},
1130
  { 0x0014, "ISO"},
1131
  { 0x0016, "ExposureCompensation"},
1132
  { 0x0017, "MeteringMode"},
1133
  { 0x0018, "AutoBracketing"},
1134
  { 0x0019, "WhiteBalance"},
1135
  { 0x001a, "WhiteBalanceMode"},
1136
  { 0x001b, "BlueBalance"},
1137
  { 0x001c, "RedBalance"},
1138
  { 0x001d, "FocalLength"},
1139
  { 0x001e, "DigitalZoom"},
1140
  { 0x001f, "Saturation"},
1141
  { 0x0020, "Contrast"},
1142
  { 0x0021, "Sharpness"},
1143
  { 0x0022, "Location"},
1144
  { 0x0023, "Hometown"},
1145
  { 0x0024, "Destination"},
1146
  { 0x0025, "HometownDST"},
1147
  { 0x0026, "DestinationDST"},
1148
  { 0x0027, "DSPFirmwareVersion"},
1149
  { 0x0028, "CPUFirmwareVersion"},
1150
  { 0x0029, "FrameNumber"},
1151
  { 0x002d, "EffectiveLV"},
1152
  { 0x0032, "ImageProcessing"},
1153
  { 0x0033, "PictureMode"},
1154
  { 0x0034, "DriveMode"},
1155
  { 0x0037, "ColorSpace"},
1156
  { 0x0038, "ImageAreaOffset"},
1157
  { 0x0039, "RawImageSize"},
1158
  { 0x003e, "PreviewImageBorders"},
1159
  { 0x003f, "LensType"},
1160
  { 0x0040, "SensitivityAdjust"},
1161
  { 0x0041, "DigitalFilter"},
1162
  { 0x0047, "Temperature"},
1163
  { 0x0048, "AELock"},
1164
  { 0x0049, "NoiseReduction"},
1165
  { 0x004d, "FlashExposureCompensation"},
1166
  { 0x004f, "ImageTone"},
1167
  { 0x0050, "ColorTemperature"},
1168
  { 0x005c, "ShakeReduction"},
1169
  { 0x005d, "ShutterCount"},
1170
  { 0x0069, "DynamicRangeExpansion"},
1171
  { 0x0071, "HighISONoiseReduction"},
1172
  { 0x0072, "AFAdjustment"},
1173
  { 0x0200, "BlackPoint"},
1174
  { 0x0201, "WhitePoint"},
1175
  { 0x0205, "ShotInfo"},
1176
  { 0x0206, "AEInfo"},
1177
  { 0x0207, "LensInfo"},
1178
  { 0x0208, "FlashInfo"},
1179
  { 0x0209, "AEMeteringSegments"},
1180
  { 0x020a, "FlashADump"},
1181
  { 0x020b, "FlashBDump"},
1182
  { 0x020d, "WB_RGGBLevelsDaylight"},
1183
  { 0x020e, "WB_RGGBLevelsShade"},
1184
  { 0x020f, "WB_RGGBLevelsCloudy"},
1185
  { 0x0210, "WB_RGGBLevelsTungsten"},
1186
  { 0x0211, "WB_RGGBLevelsFluorescentD"},
1187
  { 0x0212, "WB_RGGBLevelsFluorescentN"},
1188
  { 0x0213, "WB_RGGBLevelsFluorescentW"},
1189
  { 0x0214, "WB_RGGBLevelsFlash"},
1190
  { 0x0215, "CameraInfo"},
1191
  { 0x0216, "BatteryInfo"},
1192
  { 0x021f, "AFInfo"},
1193
  { 0x0222, "ColorInfo"},
1194
  { 0x0229, "SerialNumber"},
1195
  TAG_TABLE_END
1196
};
1197
1198
static tag_info_array tag_table_VND_MINOLTA = {
1199
  { 0x0000, "Version"},
1200
  { 0x0001, "CameraSettingsStdOld"},
1201
  { 0x0003, "CameraSettingsStdNew"},
1202
  { 0x0004, "CameraSettings7D"},
1203
  { 0x0018, "ImageStabilizationData"},
1204
  { 0x0020, "WBInfoA100"},
1205
  { 0x0040, "CompressedImageSize"},
1206
  { 0x0081, "Thumbnail"},
1207
  { 0x0088, "ThumbnailOffset"},
1208
  { 0x0089, "ThumbnailLength"},
1209
  { 0x0100, "SceneMode"},
1210
  { 0x0101, "ColorMode"},
1211
  { 0x0102, "Quality"},
1212
  { 0x0104, "FlashExposureComp"},
1213
  { 0x0105, "Teleconverter"},
1214
  { 0x0107, "ImageStabilization"},
1215
  { 0x0109, "RawAndJpgRecording"},
1216
  { 0x010a, "ZoneMatching"},
1217
  { 0x010b, "ColorTemperature"},
1218
  { 0x010c, "LensID"},
1219
  { 0x0111, "ColorCompensationFilter"},
1220
  { 0x0112, "WhiteBalanceFineTune"},
1221
  { 0x0113, "ImageStabilizationA100"},
1222
  { 0x0114, "CameraSettings5D"},
1223
  { 0x0115, "WhiteBalance"},
1224
  { 0x0e00, "PrintIM"},
1225
  { 0x0f00, "CameraSettingsZ1"},
1226
  TAG_TABLE_END
1227
};
1228
1229
static tag_info_array tag_table_VND_SIGMA = {
1230
  { 0x0002, "SerialNumber"},
1231
  { 0x0003, "DriveMode"},
1232
  { 0x0004, "ResolutionMode"},
1233
  { 0x0005, "AutofocusMode"},
1234
  { 0x0006, "FocusSetting"},
1235
  { 0x0007, "WhiteBalance"},
1236
  { 0x0008, "ExposureMode"},
1237
  { 0x0009, "MeteringMode"},
1238
  { 0x000a, "LensRange"},
1239
  { 0x000b, "ColorSpace"},
1240
  { 0x000c, "Exposure"},
1241
  { 0x000d, "Contrast"},
1242
  { 0x000e, "Shadow"},
1243
  { 0x000f, "Highlight"},
1244
  { 0x0010, "Saturation"},
1245
  { 0x0011, "Sharpness"},
1246
  { 0x0012, "FillLight"},
1247
  { 0x0014, "ColorAdjustment"},
1248
  { 0x0015, "AdjustmentMode"},
1249
  { 0x0016, "Quality"},
1250
  { 0x0017, "Firmware"},
1251
  { 0x0018, "Software"},
1252
  { 0x0019, "AutoBracket"},
1253
  TAG_TABLE_END
1254
};
1255
1256
static tag_info_array tag_table_VND_KYOCERA = {
1257
  { 0x0001, "FormatThumbnail"},
1258
  { 0x0E00, "PrintImageMatchingInfo"},
1259
  TAG_TABLE_END
1260
};
1261
1262
static tag_info_array tag_table_VND_RICOH = {
1263
  { 0x0001, "MakerNoteDataType"},
1264
  { 0x0002, "Version"},
1265
  { 0x0E00, "PrintImageMatchingInfo"},
1266
  { 0x2001, "RicohCameraInfoMakerNoteSubIFD"},
1267
  TAG_TABLE_END
1268
};
1269
1270
typedef enum mn_byte_order_t {
1271
  MN_ORDER_INTEL    = 0,
1272
  MN_ORDER_MOTOROLA = 1,
1273
  MN_ORDER_NORMAL
1274
} mn_byte_order_t;
1275
1276
typedef enum mn_offset_mode_t {
1277
  MN_OFFSET_NORMAL,
1278
  MN_OFFSET_MAKER
1279
} mn_offset_mode_t;
1280
1281
typedef struct {
1282
  tag_table_type   tag_table;
1283
  char *           make;
1284
  char *           id_string;
1285
  int              id_string_len;
1286
  int              offset;
1287
  mn_byte_order_t  byte_order;
1288
  mn_offset_mode_t offset_mode;
1289
} maker_note_type;
1290
1291
4.36k
#define FOURCC(id) (((uint32_t)(id[0])<<24) | (id[1]<<16) | (id[2]<<8) | (id[3]))
1292
1293
typedef struct {
1294
  uint64_t  size;
1295
  uint32_t  type;
1296
} isobmff_box_type;
1297
1298
typedef struct {
1299
  uint32_t  offset;
1300
  uint32_t  size;
1301
} isobmff_item_pos_type;
1302
1303
/* Some maker notes (e.g. DJI info tag) require custom parsing */
1304
#define REQUIRES_CUSTOM_PARSING NULL
1305
1306
/* Remember to update PHP_MINFO if updated */
1307
static const maker_note_type maker_note_array[] = {
1308
  { tag_table_VND_CANON,     "Canon",                   NULL,               0,  0,  MN_ORDER_INTEL,    MN_OFFSET_NORMAL},
1309
  { tag_table_VND_CASIO,     "CASIO",                   NULL,               0,  0,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
1310
  { tag_table_VND_FUJI,      "FUJIFILM",                "FUJIFILM\x0C\x00\x00\x00",     12, 12, MN_ORDER_INTEL,    MN_OFFSET_MAKER},
1311
  { tag_table_VND_NIKON,     "NIKON",                   "Nikon\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1312
  { tag_table_VND_NIKON_990, "NIKON",                   NULL,               0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1313
  { tag_table_VND_OLYMPUS,   "OLYMPUS OPTICAL CO.,LTD", "OLYMP\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1314
  { tag_table_VND_SAMSUNG,   "SAMSUNG",                 NULL,               0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1315
  { tag_table_VND_PANASONIC, "Panasonic",               "Panasonic\x00\x00\x00",      12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1316
  { REQUIRES_CUSTOM_PARSING, "DJI",                     "[ae_dbg_info:",          13, 13, MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
1317
  { tag_table_VND_DJI,       "DJI",                     NULL,               0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1318
  { tag_table_VND_SONY,      "SONY",                    "SONY DSC \x00\x00\x00",      12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1319
  { tag_table_VND_SONY,      "SONY",                    NULL,               0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1320
  { tag_table_VND_PENTAX,    "PENTAX",                  "AOC\x00",              6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1321
  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL,               0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1322
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "SIGMA\x00\x00\x00",        10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1323
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "FOVEON\x00\x00\x00",       10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1324
  { tag_table_VND_KYOCERA,   "KYOCERA, CONTAX",     "KYOCERA            \x00\x00\x00",  22, 22, MN_ORDER_NORMAL,   MN_OFFSET_MAKER},
1325
  { tag_table_VND_RICOH,   "RICOH",         "Ricoh",              5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
1326
  { tag_table_VND_RICOH,     "RICOH",         "RICOH",              5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
1327
1328
  /* These re-uses existing formats */
1329
  { tag_table_VND_OLYMPUS,   "AGFA",          "AGFA \x00\x01",          8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
1330
  { tag_table_VND_OLYMPUS,   "EPSON",         "EPSON\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL}
1331
};
1332
/* }}} */
1333
1334
static HashTable *exif_make_tag_ht(tag_info_type *tag_table)
1335
16
{
1336
16
  HashTable *ht = malloc(sizeof(HashTable));
1337
16
  zend_hash_init(ht, 0, NULL, NULL, 1);
1338
670
  while (tag_table->Tag != TAG_END_OF_LIST) {
1339
654
    if (!zend_hash_index_add_ptr(ht, tag_table->Tag, tag_table->Desc)) {
1340
0
      zend_error(E_CORE_ERROR, "Duplicate tag %x", tag_table->Tag);
1341
0
    }
1342
654
    tag_table++;
1343
654
  }
1344
16
  return ht;
1345
16
}
1346
1347
static void exif_tag_ht_dtor(zval *zv)
1348
0
{
1349
0
  HashTable *ht = Z_PTR_P(zv);
1350
0
  zend_hash_destroy(ht);
1351
0
  free(ht);
1352
0
}
1353
1354
static HashTable *exif_get_tag_ht(tag_info_type *tag_table)
1355
14.9M
{
1356
14.9M
  HashTable *ht;
1357
1358
14.9M
  if (!EXIF_G(tag_table_cache)) {
1359
1
    EXIF_G(tag_table_cache) = malloc(sizeof(HashTable));
1360
1
    zend_hash_init(EXIF_G(tag_table_cache), 0, NULL, exif_tag_ht_dtor, 1);
1361
1
  }
1362
1363
14.9M
  ht = zend_hash_index_find_ptr(EXIF_G(tag_table_cache), (uintptr_t) tag_table);
1364
14.9M
  if (ht) {
1365
14.9M
    return ht;
1366
14.9M
  }
1367
1368
16
  ht = exif_make_tag_ht(tag_table);
1369
16
  zend_hash_index_add_new_ptr(EXIF_G(tag_table_cache), (uintptr_t) tag_table, ht);
1370
16
  return ht;
1371
14.9M
}
1372
1373
/* {{{ exif_get_tagname
1374
  Get headername for tag_num or NULL if not defined */
1375
static char *exif_get_tagname(int tag_num, tag_table_type tag_table)
1376
0
{
1377
0
  return zend_hash_index_find_ptr(exif_get_tag_ht(tag_table), tag_num);
1378
0
}
1379
/* }}} */
1380
1381
static char *exif_get_tagname_debug(int tag_num, tag_table_type tag_table)
1382
14.8M
{
1383
14.8M
  char *desc = zend_hash_index_find_ptr(exif_get_tag_ht(tag_table), tag_num);
1384
14.8M
  if (desc) {
1385
1.90M
    return desc;
1386
1.90M
  }
1387
12.9M
  return "UndefinedTag";
1388
14.8M
}
1389
1390
static char *exif_get_tagname_key(int tag_num, char *buf, size_t buf_size, tag_table_type tag_table)
1391
83.0k
{
1392
83.0k
  char *desc = zend_hash_index_find_ptr(exif_get_tag_ht(tag_table), tag_num);
1393
83.0k
  if (desc) {
1394
32.3k
    return desc;
1395
32.3k
  }
1396
50.7k
  snprintf(buf, buf_size, "UndefinedTag:0x%04X", tag_num);
1397
50.7k
  return buf;
1398
83.0k
}
1399
1400
/* {{{ exif_char_dump
1401
 * Do not use! This is a debug function... */
1402
#ifdef EXIF_DEBUG
1403
static char* exif_char_dump(char * addr, int len, int offset)
1404
{
1405
  static char buf[4096+1];
1406
  static char tmp[20];
1407
  int c, i, p=0, n = 5+31;
1408
1409
  p += slprintf(buf+p, sizeof(buf)-p, "\nDump Len: %08X (%d)", len, len);
1410
  if (len) {
1411
    for(i=0; i<len+15 && p+n<=sizeof(buf); i++) {
1412
      if (i%16==0) {
1413
        p += slprintf(buf+p, sizeof(buf)-p, "\n%08X: ", i+offset);
1414
      }
1415
      if (i<len) {
1416
        c = *((unsigned char *)addr++);
1417
        p += slprintf(buf+p, sizeof(buf)-p, "%02X ", c);
1418
        tmp[i%16] = c>=32 ? c : '.';
1419
        tmp[(i%16)+1] = '\0';
1420
      } else {
1421
        p += slprintf(buf+p, sizeof(buf)-p, "   ");
1422
      }
1423
      if (i%16==15) {
1424
        p += slprintf(buf+p, sizeof(buf)-p, "    %s", tmp);
1425
        if (i>=len) {
1426
          break;
1427
        }
1428
      }
1429
    }
1430
  }
1431
  buf[sizeof(buf)-1] = '\0';
1432
  return buf;
1433
}
1434
#endif
1435
/* }}} */
1436
1437
/* {{{ php_jpg_get16
1438
   Get 16 bits motorola order (always) for jpeg header stuff.
1439
*/
1440
static int php_jpg_get16(void *value)
1441
6.77k
{
1442
6.77k
  return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1443
6.77k
}
1444
/* }}} */
1445
1446
/* {{{ php_ifd_get16u
1447
 * Convert a 16 bit unsigned value from file's native byte order */
1448
static int php_ifd_get16u(void *value, int motorola_intel)
1449
41.6M
{
1450
41.6M
  if (motorola_intel) {
1451
8.00M
    return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1452
33.5M
  } else {
1453
33.5M
    return (((uchar *)value)[1] << 8) | ((uchar *)value)[0];
1454
33.5M
  }
1455
41.6M
}
1456
/* }}} */
1457
1458
/* {{{ php_ifd_get16s
1459
 * Convert a 16 bit signed value from file's native byte order */
1460
static signed short php_ifd_get16s(void *value, int motorola_intel)
1461
300k
{
1462
300k
  return (signed short)php_ifd_get16u(value, motorola_intel);
1463
300k
}
1464
/* }}} */
1465
1466
/* {{{ php_ifd_get32u
1467
 * Convert a 32 bit unsigned value from file's native byte order */
1468
static unsigned php_ifd_get32u(void *void_value, int motorola_intel)
1469
34.9M
{
1470
34.9M
  uchar *value = (uchar *) void_value;
1471
34.9M
  if (motorola_intel) {
1472
7.81M
    return  ((unsigned)value[0] << 24)
1473
7.81M
        | ((unsigned)value[1] << 16)
1474
7.81M
        | ((unsigned)value[2] << 8 )
1475
7.81M
        | ((unsigned)value[3]      );
1476
27.1M
  } else {
1477
27.1M
    return  ((unsigned)value[3] << 24)
1478
27.1M
        | ((unsigned)value[2] << 16)
1479
27.1M
        | ((unsigned)value[1] << 8 )
1480
27.1M
        | ((unsigned)value[0]      );
1481
27.1M
  }
1482
34.9M
}
1483
/* }}} */
1484
1485
/* {{{ php_ifd_get64u
1486
 * Convert a 64 bit unsigned value from file's native byte order */
1487
static uint64_t php_ifd_get64u(void *void_value, int motorola_intel)
1488
81.3k
{
1489
81.3k
  uchar *value = (uchar *) void_value;
1490
81.3k
  if (motorola_intel) {
1491
1.19k
    return ((uint64_t)value[0] << 56)
1492
1.19k
      | ((uint64_t)value[1] << 48)
1493
1.19k
      | ((uint64_t)value[2] << 40)
1494
1.19k
      | ((uint64_t)value[3] << 32)
1495
1.19k
      | ((uint64_t)value[4] << 24)
1496
1.19k
      | ((uint64_t)value[5] << 16)
1497
1.19k
      | ((uint64_t)value[6] << 8 )
1498
1.19k
      | ((uint64_t)value[7]      );
1499
80.1k
  } else {
1500
80.1k
    return ((uint64_t)value[7] << 56)
1501
80.1k
      | ((uint64_t)value[6] << 48)
1502
80.1k
      | ((uint64_t)value[5] << 40)
1503
80.1k
      | ((uint64_t)value[4] << 32)
1504
80.1k
      | ((uint64_t)value[3] << 24)
1505
80.1k
      | ((uint64_t)value[2] << 16)
1506
80.1k
      | ((uint64_t)value[1] << 8 )
1507
80.1k
      | ((uint64_t)value[0]      );
1508
80.1k
  }
1509
81.3k
}
1510
/* }}} */
1511
1512
/* {{{ php_ifd_get32u
1513
 * Convert a 32 bit signed value from file's native byte order */
1514
static unsigned php_ifd_get32s(void *value, int motorola_intel)
1515
542k
{
1516
542k
  return (int) php_ifd_get32u(value, motorola_intel);
1517
542k
}
1518
/* }}} */
1519
1520
/* {{{ php_ifd_set16u
1521
 * Write 16 bit unsigned value to data */
1522
static void php_ifd_set16u(char *data, unsigned int value, int motorola_intel)
1523
0
{
1524
0
  if (motorola_intel) {
1525
0
    data[0] = (value & 0xFF00) >> 8;
1526
0
    data[1] = (value & 0x00FF);
1527
0
  } else {
1528
0
    data[1] = (value & 0xFF00) >> 8;
1529
0
    data[0] = (value & 0x00FF);
1530
0
  }
1531
0
}
1532
/* }}} */
1533
1534
/* {{{ php_ifd_set32u
1535
 * Convert a 32 bit unsigned value from file's native byte order */
1536
static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
1537
0
{
1538
0
  if (motorola_intel) {
1539
0
    data[0] = (value & 0xFF000000) >> 24;
1540
0
    data[1] = (char) ((value & 0x00FF0000) >> 16);
1541
0
    data[2] = (value & 0x0000FF00) >>  8;
1542
0
    data[3] = (value & 0x000000FF);
1543
0
  } else {
1544
0
    data[3] = (value & 0xFF000000) >> 24;
1545
0
    data[2] = (char) ((value & 0x00FF0000) >> 16);
1546
0
    data[1] = (value & 0x0000FF00) >>  8;
1547
0
    data[0] = (value & 0x000000FF);
1548
0
  }
1549
0
}
1550
/* }}} */
1551
1552
279k
static float php_ifd_get_float(char *data) {
1553
279k
  union { uint32_t i; float f; } u;
1554
279k
  u.i = php_ifd_get32u(data, 0);
1555
279k
  return u.f;
1556
279k
}
1557
1558
80.1k
static double php_ifd_get_double(char *data) {
1559
80.1k
  union { uint64_t i; double f; } u;
1560
80.1k
  u.i = php_ifd_get64u(data, 0);
1561
80.1k
  return u.f;
1562
80.1k
}
1563
1564
#ifdef EXIF_DEBUG
1565
char * exif_dump_data(int *dump_free, int format, int components, int motorola_intel, char *value_ptr) /* {{{ */
1566
{
1567
  char *dump;
1568
  int len;
1569
1570
  *dump_free = 0;
1571
  if (format == TAG_FMT_STRING) {
1572
    return value_ptr ? value_ptr : "<no data>";
1573
  }
1574
  if (format == TAG_FMT_UNDEFINED) {
1575
    return "<undefined>";
1576
  }
1577
  if (format == TAG_FMT_IFD) {
1578
    return "";
1579
  }
1580
  if (format == TAG_FMT_SINGLE || format == TAG_FMT_DOUBLE) {
1581
    return "<not implemented>";
1582
  }
1583
  *dump_free = 1;
1584
  if (components > 1) {
1585
    len = spprintf(&dump, 0, "(%d) {", components);
1586
  } else {
1587
    len = spprintf(&dump, 0, "{");
1588
  }
1589
  while(components > 0) {
1590
    switch(format) {
1591
      case TAG_FMT_BYTE:
1592
      case TAG_FMT_UNDEFINED:
1593
      case TAG_FMT_STRING:
1594
      case TAG_FMT_SBYTE:
1595
        dump = erealloc(dump, len + 4 + 1);
1596
        snprintf(dump + len, 4 + 1, "0x%02X", *value_ptr);
1597
        len += 4;
1598
        value_ptr++;
1599
        break;
1600
      case TAG_FMT_USHORT:
1601
      case TAG_FMT_SSHORT:
1602
        dump = erealloc(dump, len + 6 + 1);
1603
        snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get16s(value_ptr, motorola_intel));
1604
        len += 6;
1605
        value_ptr += 2;
1606
        break;
1607
      case TAG_FMT_ULONG:
1608
      case TAG_FMT_SLONG:
1609
        dump = erealloc(dump, len + 6 + 1);
1610
        snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get32s(value_ptr, motorola_intel));
1611
        len += 6;
1612
        value_ptr += 4;
1613
        break;
1614
      case TAG_FMT_URATIONAL:
1615
      case TAG_FMT_SRATIONAL:
1616
        dump = erealloc(dump, len + 13 + 1);
1617
        snprintf(dump + len, 13 + 1, "0x%04X/0x%04X", php_ifd_get32s(value_ptr, motorola_intel), php_ifd_get32s(value_ptr+4, motorola_intel));
1618
        len += 13;
1619
        value_ptr += 8;
1620
        break;
1621
    }
1622
    if (components > 0) {
1623
      dump = erealloc(dump, len + 2 + 1);
1624
      snprintf(dump + len, 2 + 1, ", ");
1625
      len += 2;
1626
      components--;
1627
    } else{
1628
      break;
1629
    }
1630
  }
1631
  dump = erealloc(dump, len + 1 + 1);
1632
  snprintf(dump + len, 1 + 1, "}");
1633
  return dump;
1634
}
1635
/* }}} */
1636
#endif
1637
1638
/* {{{ exif_convert_any_format
1639
 * Evaluate number, be it int, rational, or float from directory. */
1640
static double exif_convert_any_format(void *value, int format, int motorola_intel)
1641
1.57k
{
1642
1.57k
  int     s_den;
1643
1.57k
  unsigned  u_den;
1644
1645
1.57k
  switch(format) {
1646
121
    case TAG_FMT_SBYTE:     return *(signed char *)value;
1647
618
    case TAG_FMT_BYTE:      return *(uchar *)value;
1648
1649
4
    case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1650
3
    case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1651
1652
304
    case TAG_FMT_URATIONAL:
1653
304
      u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1654
304
      if (u_den == 0) {
1655
161
        return 0;
1656
161
      } else {
1657
143
        return (double)php_ifd_get32u(value, motorola_intel) / u_den;
1658
143
      }
1659
1660
86
    case TAG_FMT_SRATIONAL:
1661
86
      s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1662
86
      if (s_den == 0) {
1663
26
        return 0;
1664
60
      } else {
1665
60
        return (double)php_ifd_get32s(value, motorola_intel) / s_den;
1666
60
      }
1667
1668
91
    case TAG_FMT_SSHORT:    return (signed short)php_ifd_get16u(value, motorola_intel);
1669
1
    case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1670
1671
    /* Not sure if this is correct (never seen float used in Exif format) */
1672
74
    case TAG_FMT_SINGLE:
1673
#ifdef EXIF_DEBUG
1674
      php_error_docref(NULL, E_NOTICE, "Found value of type single");
1675
#endif
1676
74
      return (double) php_ifd_get_float(value);
1677
256
    case TAG_FMT_DOUBLE:
1678
#ifdef EXIF_DEBUG
1679
      php_error_docref(NULL, E_NOTICE, "Found value of type double");
1680
#endif
1681
256
      return php_ifd_get_double(value);
1682
1.57k
  }
1683
19
  return 0;
1684
1.57k
}
1685
/* }}} */
1686
1687
/* {{{ exif_rewrite_tag_format_to_unsigned
1688
 * Rewrite format tag so that it specifies an unsigned type for a tag */
1689
static int exif_rewrite_tag_format_to_unsigned(int format)
1690
4.19k
{
1691
4.19k
  switch(format) {
1692
73
    case TAG_FMT_SBYTE: return TAG_FMT_BYTE;
1693
390
    case TAG_FMT_SRATIONAL: return TAG_FMT_URATIONAL;
1694
152
    case TAG_FMT_SSHORT: return TAG_FMT_USHORT;
1695
1.41k
    case TAG_FMT_SLONG: return TAG_FMT_ULONG;
1696
4.19k
  }
1697
2.16k
  return format;
1698
4.19k
}
1699
/* }}} */
1700
1701
/* Use saturation for out of bounds values to avoid UB */
1702
816
static size_t float_to_size_t(float x) {
1703
816
  if (x < 0.0f || zend_isnan(x)) {
1704
242
    return 0;
1705
574
  } else if (x > (float) SIZE_MAX) {
1706
246
    return SIZE_MAX;
1707
328
  } else {
1708
328
    return (size_t) x;
1709
328
  }
1710
816
}
1711
1712
275
static size_t double_to_size_t(double x) {
1713
275
  if (x < 0.0 || zend_isnan(x)) {
1714
23
    return 0;
1715
252
  } else if (x > (double) SIZE_MAX) {
1716
120
    return SIZE_MAX;
1717
132
  } else {
1718
132
    return (size_t) x;
1719
132
  }
1720
275
}
1721
1722
/* {{{ exif_convert_any_to_int
1723
 * Evaluate number, be it int, rational, or float from directory. */
1724
static size_t exif_convert_any_to_int(void *value, int format, int motorola_intel)
1725
4.38k
{
1726
4.38k
  switch (format) {
1727
0
    case TAG_FMT_SBYTE:     return *(signed char *)value;
1728
987
    case TAG_FMT_BYTE:      return *(uchar *)value;
1729
1730
226
    case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1731
1.58k
    case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1732
1733
392
    case TAG_FMT_URATIONAL: {
1734
392
      unsigned u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1735
392
      if (u_den == 0) {
1736
15
        return 0;
1737
377
      } else {
1738
377
        return php_ifd_get32u(value, motorola_intel) / u_den;
1739
377
      }
1740
392
    }
1741
1742
27
    case TAG_FMT_SRATIONAL: {
1743
27
      int s_num = php_ifd_get32s(value, motorola_intel);
1744
27
      int s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1745
27
      if (s_den == 0) {
1746
0
        return 0;
1747
27
      } else if (s_num == INT_MIN && s_den == -1) {
1748
3
        return INT_MAX;
1749
24
      } else {
1750
24
        return s_num / s_den;
1751
24
      }
1752
27
    }
1753
1754
0
    case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
1755
0
    case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1756
1757
    /* Not sure if this is correct (never seen float used in Exif format) */
1758
816
    case TAG_FMT_SINGLE:
1759
#ifdef EXIF_DEBUG
1760
      php_error_docref(NULL, E_NOTICE, "Found value of type single");
1761
#endif
1762
816
      return float_to_size_t(php_ifd_get_float(value));
1763
275
    case TAG_FMT_DOUBLE:
1764
#ifdef EXIF_DEBUG
1765
      php_error_docref(NULL, E_NOTICE, "Found value of type double");
1766
#endif
1767
275
      return double_to_size_t(php_ifd_get_double(value));
1768
4.38k
  }
1769
80
  return 0;
1770
4.38k
}
1771
/* }}} */
1772
1773
/* {{{ struct image_info_value, image_info_list */
1774
#ifndef WORD
1775
#define WORD unsigned short
1776
#endif
1777
#ifndef DWORD
1778
#define DWORD unsigned int
1779
#endif
1780
1781
typedef struct {
1782
  int             num;
1783
  int             den;
1784
} signed_rational;
1785
1786
typedef struct {
1787
  unsigned int    num;
1788
  unsigned int    den;
1789
} unsigned_rational;
1790
1791
typedef union _image_info_value {
1792
  char        *s;
1793
  unsigned            u;
1794
  int         i;
1795
  float               f;
1796
  double              d;
1797
  signed_rational   sr;
1798
  unsigned_rational   ur;
1799
  union _image_info_value   *list;
1800
} image_info_value;
1801
1802
typedef struct {
1803
  WORD                tag;
1804
  WORD                format;
1805
  DWORD               length;
1806
  DWORD               dummy;  /* value ptr of tiff directory entry */
1807
  char        *name;
1808
  image_info_value    value;
1809
} image_info_data;
1810
1811
typedef struct {
1812
  int                 count;
1813
  int                 alloc_count;
1814
  image_info_data   *list;
1815
} image_info_list;
1816
/* }}} */
1817
1818
/* {{{ exif_get_sectionname
1819
 Returns the name of a section
1820
*/
1821
9.46k
#define SECTION_FILE        0
1822
9.97k
#define SECTION_COMPUTED    1
1823
89.5k
#define SECTION_ANY_TAG     2
1824
142k
#define SECTION_IFD0        3
1825
257k
#define SECTION_THUMBNAIL   4
1826
678k
#define SECTION_COMMENT     5
1827
1.99k
#define SECTION_APP0        6
1828
160k
#define SECTION_EXIF        7
1829
2.77k
#define SECTION_FPIX        8
1830
25.2k
#define SECTION_GPS         9
1831
12.0k
#define SECTION_INTEROP     10
1832
3.63k
#define SECTION_APP12       11
1833
12.0k
#define SECTION_WINXP       12
1834
8.39k
#define SECTION_MAKERNOTE   13
1835
89.5k
#define SECTION_COUNT       14
1836
1837
1.99k
#define FOUND_FILE          (1<<SECTION_FILE)
1838
2.04k
#define FOUND_COMPUTED      (1<<SECTION_COMPUTED)
1839
85.7k
#define FOUND_ANY_TAG       (1<<SECTION_ANY_TAG)
1840
5.65k
#define FOUND_IFD0          (1<<SECTION_IFD0)
1841
7.93k
#define FOUND_THUMBNAIL     (1<<SECTION_THUMBNAIL)
1842
#define FOUND_COMMENT       (1<<SECTION_COMMENT)
1843
#define FOUND_APP0          (1<<SECTION_APP0)
1844
34.1k
#define FOUND_EXIF          (1<<SECTION_EXIF)
1845
#define FOUND_FPIX          (1<<SECTION_FPIX)
1846
7.89k
#define FOUND_GPS           (1<<SECTION_GPS)
1847
3.05k
#define FOUND_INTEROP       (1<<SECTION_INTEROP)
1848
#define FOUND_APP12         (1<<SECTION_APP12)
1849
2.32k
#define FOUND_WINXP         (1<<SECTION_WINXP)
1850
2.17k
#define FOUND_MAKERNOTE     (1<<SECTION_MAKERNOTE)
1851
1852
static const char *exif_get_sectionname(int section)
1853
32.6k
{
1854
32.6k
  switch(section) {
1855
1.99k
    case SECTION_FILE:      return "FILE";
1856
2.77k
    case SECTION_COMPUTED:  return "COMPUTED";
1857
3.09k
    case SECTION_ANY_TAG:   return "ANY_TAG";
1858
3.15k
    case SECTION_IFD0:      return "IFD0";
1859
2.64k
    case SECTION_THUMBNAIL: return "THUMBNAIL";
1860
2.15k
    case SECTION_COMMENT:   return "COMMENT";
1861
1.99k
    case SECTION_APP0:      return "APP0";
1862
2.52k
    case SECTION_EXIF:      return "EXIF";
1863
1.99k
    case SECTION_FPIX:      return "FPIX";
1864
2.06k
    case SECTION_GPS:       return "GPS";
1865
2.08k
    case SECTION_INTEROP:   return "INTEROP";
1866
2.05k
    case SECTION_APP12:     return "APP12";
1867
2.03k
    case SECTION_WINXP:     return "WINXP";
1868
2.13k
    case SECTION_MAKERNOTE: return "MAKERNOTE";
1869
32.6k
  }
1870
0
  return "";
1871
32.6k
}
1872
1873
static tag_table_type exif_get_tag_table(int section)
1874
61.8k
{
1875
61.8k
  switch(section) {
1876
0
    case SECTION_FILE:      return &tag_table_IFD[0];
1877
0
    case SECTION_COMPUTED:  return &tag_table_IFD[0];
1878
0
    case SECTION_ANY_TAG:   return &tag_table_IFD[0];
1879
2.50k
    case SECTION_IFD0:      return &tag_table_IFD[0];
1880
18.9k
    case SECTION_THUMBNAIL: return &tag_table_IFD[0];
1881
0
    case SECTION_COMMENT:   return &tag_table_IFD[0];
1882
0
    case SECTION_APP0:      return &tag_table_IFD[0];
1883
28.3k
    case SECTION_EXIF:      return &tag_table_IFD[0];
1884
0
    case SECTION_FPIX:      return &tag_table_IFD[0];
1885
6.63k
    case SECTION_GPS:       return &tag_table_GPS[0];
1886
3.08k
    case SECTION_INTEROP:   return &tag_table_IOP[0];
1887
0
    case SECTION_APP12:     return &tag_table_IFD[0];
1888
2.30k
    case SECTION_WINXP:     return &tag_table_IFD[0];
1889
61.8k
  }
1890
0
  return &tag_table_IFD[0];
1891
61.8k
}
1892
/* }}} */
1893
1894
/* {{{ exif_get_sectionlist
1895
   Return list of sectionnames specified by sectionlist. Return value must be freed
1896
*/
1897
static char *exif_get_sectionlist(int sectionlist)
1898
1.99k
{
1899
1.99k
  int i, len, ml = 0;
1900
1.99k
  char *sections;
1901
1902
29.8k
  for(i=0; i<SECTION_COUNT; i++) {
1903
27.8k
    ml += strlen(exif_get_sectionname(i))+2;
1904
27.8k
  }
1905
1.99k
  sections = safe_emalloc(ml, 1, 1);
1906
1.99k
  sections[0] = '\0';
1907
1.99k
  len = 0;
1908
29.8k
  for(i=0; i<SECTION_COUNT; i++) {
1909
27.8k
    if (sectionlist&(1<<i)) {
1910
3.69k
      snprintf(sections+len, ml-len, "%s, ", exif_get_sectionname(i));
1911
3.69k
      len = strlen(sections);
1912
3.69k
    }
1913
27.8k
  }
1914
1.99k
  if (len>2)
1915
1.26k
    sections[len-2] = '\0';
1916
1.99k
  return sections;
1917
1.99k
}
1918
/* }}} */
1919
1920
/* {{{ struct image_info_type
1921
   This structure stores Exif header image elements in a simple manner
1922
   Used to store camera data as extracted from the various ways that it can be
1923
   stored in a nexif header
1924
*/
1925
1926
typedef struct {
1927
  int     type;
1928
  size_t  size;
1929
  uchar   *data;
1930
} file_section;
1931
1932
typedef struct {
1933
  int             count;
1934
  int             alloc_count;
1935
  file_section    *list;
1936
} file_section_list;
1937
1938
typedef struct {
1939
  image_filetype  filetype;
1940
  size_t          width, height;
1941
  size_t          size;
1942
  size_t          offset;
1943
  char          *data;
1944
} thumbnail_data;
1945
1946
typedef struct {
1947
  char      *value;
1948
  size_t      size;
1949
  int       tag;
1950
} xp_field_type;
1951
1952
typedef struct {
1953
  int             count;
1954
  xp_field_type   *list;
1955
} xp_field_list;
1956
1957
/* This structure is used to store a section of a Jpeg file. */
1958
typedef struct {
1959
  php_stream      *infile;
1960
  char            *FileName;
1961
  time_t          FileDateTime;
1962
  size_t          FileSize;
1963
  image_filetype  FileType;
1964
  int             Height, Width;
1965
  int             IsColor;
1966
1967
  char            *make;
1968
  char            *model;
1969
1970
  float           ApertureFNumber;
1971
  float           ExposureTime;
1972
  double          FocalplaneUnits;
1973
  float           CCDWidth;
1974
  double          FocalplaneXRes;
1975
  size_t          ExifImageWidth;
1976
  float           FocalLength;
1977
  float           Distance;
1978
1979
  int             motorola_intel; /* 1 Motorola; 0 Intel */
1980
1981
  char            *UserComment;
1982
  int             UserCommentLength;
1983
  char            *UserCommentEncoding;
1984
  char            *encode_unicode;
1985
  char            *decode_unicode_be;
1986
  char            *decode_unicode_le;
1987
  char            *encode_jis;
1988
  char            *decode_jis_be;
1989
  char            *decode_jis_le;
1990
  char            *Copyright;/* EXIF standard defines Copyright as "<Photographer> [ '\0' <Editor> ] ['\0']" */
1991
  char            *CopyrightPhotographer;
1992
  char            *CopyrightEditor;
1993
1994
  xp_field_list   xp_fields;
1995
1996
  thumbnail_data  Thumbnail;
1997
  /* other */
1998
  int             sections_found; /* FOUND_<marker> */
1999
  image_info_list info_list[SECTION_COUNT];
2000
  /* for parsing */
2001
  int             read_thumbnail;
2002
  int             read_all;
2003
  int             ifd_nesting_level;
2004
  int             ifd_count;
2005
  int             num_errors;
2006
  /* internal */
2007
  file_section_list   file;
2008
} image_info_type;
2009
/* }}} */
2010
2011
// EXIF_DEBUG can produce lots of messages
2012
#ifndef EXIF_DEBUG
2013
30.5M
#define EXIF_MAX_ERRORS 10
2014
#else
2015
#define EXIF_MAX_ERRORS 100000
2016
#endif
2017
2018
/* {{{ exif_error_docref */
2019
static void exif_error_docref(const char *docref EXIFERR_DC, image_info_type *ImageInfo, int type, const char *format, ...)
2020
15.2M
{
2021
15.2M
  va_list args;
2022
2023
15.2M
  if (ImageInfo) {
2024
15.2M
    if (++ImageInfo->num_errors > EXIF_MAX_ERRORS) {
2025
15.2M
      if (ImageInfo->num_errors == EXIF_MAX_ERRORS+1) {
2026
771
        php_error_docref(docref, type,
2027
771
          "Further exif parsing errors have been suppressed");
2028
771
      }
2029
15.2M
      return;
2030
15.2M
    }
2031
15.2M
  }
2032
2033
15.2M
  va_start(args, format);
2034
#ifdef EXIF_DEBUG
2035
  {
2036
    char *buf;
2037
2038
    spprintf(&buf, 0, "%s(%ld): %s", _file, _line, format);
2039
    php_verror(docref, ImageInfo && ImageInfo->FileName ? ImageInfo->FileName:"", type, buf, args);
2040
    efree(buf);
2041
  }
2042
#else
2043
10.9k
  php_verror(docref, ImageInfo && ImageInfo->FileName ? ImageInfo->FileName:"", type, format, args);
2044
10.9k
#endif
2045
10.9k
  va_end(args);
2046
10.9k
}
2047
/* }}} */
2048
2049
/* {{{ jpeg_sof_info */
2050
typedef struct {
2051
  int     bits_per_sample;
2052
  size_t  width;
2053
  size_t  height;
2054
  int     num_components;
2055
} jpeg_sof_info;
2056
/* }}} */
2057
2058
/* Base address for offset references, together with valid memory range.
2059
 * The valid range does not necessarily include the offset base. */
2060
typedef struct {
2061
  char *offset_base;
2062
  char *valid_start; /* inclusive */
2063
  char *valid_end;   /* exclusive */
2064
} exif_offset_info;
2065
2066
201k
static zend_always_inline bool ptr_offset_overflows(const char *ptr, size_t offset) {
2067
201k
  return UINTPTR_MAX - (uintptr_t) ptr < offset;
2068
201k
}
2069
2070
static inline void exif_offset_info_init(
2071
98.2k
    exif_offset_info *info, char *offset_base, char *valid_start, size_t valid_length) {
2072
98.2k
  ZEND_ASSERT(!ptr_offset_overflows(valid_start, valid_length));
2073
#ifdef __SANITIZE_ADDRESS__
2074
  ZEND_ASSERT(!__asan_region_is_poisoned(valid_start, valid_length));
2075
#endif
2076
98.2k
  info->offset_base = offset_base;
2077
98.2k
  info->valid_start = valid_start;
2078
98.2k
  info->valid_end = valid_start + valid_length;
2079
98.2k
}
2080
2081
/* Try to get a pointer at offset_base+offset with length dereferenceable bytes. */
2082
static inline char *exif_offset_info_try_get(
2083
50.1k
    const exif_offset_info *info, size_t offset, size_t length) {
2084
50.1k
  char *start, *end;
2085
50.1k
  if (ptr_offset_overflows(info->offset_base, offset)) {
2086
11
    return NULL;
2087
11
  }
2088
2089
50.1k
  start = info->offset_base + offset;
2090
50.1k
  if (ptr_offset_overflows(start, length)) {
2091
0
    return NULL;
2092
0
  }
2093
2094
50.1k
  end = start + length;
2095
50.1k
  if (start < info->valid_start || end > info->valid_end) {
2096
33.6k
    return NULL;
2097
33.6k
  }
2098
2099
16.4k
  return start;
2100
50.1k
}
2101
2102
static inline bool exif_offset_info_contains(
2103
3.26k
    const exif_offset_info *info, const char *start, size_t length) {
2104
3.26k
  if (ptr_offset_overflows(start, length)) {
2105
0
    return false;
2106
0
  }
2107
2108
  /* start and valid_start are both inclusive, end and valid_end are both exclusive,
2109
   * so we use >= and <= to do the checks, respectively. */
2110
3.26k
  const char *end = start + length;
2111
3.26k
  return start >= info->valid_start && end <= info->valid_end;
2112
3.26k
}
2113
2114
#ifdef EXIF_DEBUG
2115
static inline int exif_offset_info_length(const exif_offset_info *info)
2116
{
2117
  return info->valid_end - info->valid_start;
2118
}
2119
#endif
2120
2121
/* {{{ exif_file_sections_add
2122
 Add a file_section to image_info
2123
 returns the used block or -1. if size>0 and data == NULL buffer of size is allocated
2124
*/
2125
static int exif_file_sections_add(image_info_type *ImageInfo, int type, size_t size, uchar *data)
2126
487k
{
2127
487k
  int count = ImageInfo->file.count;
2128
487k
  if (count == ImageInfo->file.alloc_count) {
2129
5.82k
    int new_alloc_count = ImageInfo->file.alloc_count ? ImageInfo->file.alloc_count * 2 : 1;
2130
5.82k
    ImageInfo->file.list = safe_erealloc(
2131
5.82k
      ImageInfo->file.list, new_alloc_count, sizeof(file_section), 0);
2132
5.82k
    ImageInfo->file.alloc_count = new_alloc_count;
2133
5.82k
  }
2134
2135
487k
  ImageInfo->file.list[count].type = 0xFFFF;
2136
487k
  ImageInfo->file.list[count].data = NULL;
2137
487k
  ImageInfo->file.list[count].size = 0;
2138
487k
  ImageInfo->file.count = count+1;
2139
487k
  if (!size) {
2140
0
    data = NULL;
2141
487k
  } else if (data == NULL) {
2142
487k
    data = safe_emalloc(size, 1, 0);
2143
487k
  }
2144
487k
  ImageInfo->file.list[count].type = type;
2145
487k
  ImageInfo->file.list[count].data = data;
2146
487k
  ImageInfo->file.list[count].size = size;
2147
487k
  return count;
2148
487k
}
2149
/* }}} */
2150
2151
/* {{{ exif_file_sections_realloc
2152
 Reallocate a file section returns 0 on success and -1 on failure
2153
*/
2154
static int exif_file_sections_realloc(image_info_type *ImageInfo, int section_index, size_t size)
2155
44.0k
{
2156
44.0k
  void *tmp;
2157
2158
  /* This is not a malloc/realloc check. It is a plausibility check for the
2159
   * function parameters (requirements engineering).
2160
   */
2161
44.0k
  if (section_index >= ImageInfo->file.count) {
2162
0
    EXIF_ERRLOG_FSREALLOC(ImageInfo)
2163
0
    return -1;
2164
0
  }
2165
44.0k
  tmp = safe_erealloc(ImageInfo->file.list[section_index].data, 1, size, 0);
2166
44.0k
  ImageInfo->file.list[section_index].data = tmp;
2167
44.0k
  ImageInfo->file.list[section_index].size = size;
2168
44.0k
  return 0;
2169
44.0k
}
2170
/* }}} */
2171
2172
/* {{{ exif_file_section_free
2173
   Discard all file_sections in ImageInfo
2174
*/
2175
static void exif_file_sections_free(image_info_type *ImageInfo)
2176
1.99k
{
2177
1.99k
  if (ImageInfo->file.count) {
2178
489k
    for (int i = 0; i<ImageInfo->file.count; i++) {
2179
487k
      EFREE_IF(ImageInfo->file.list[i].data);
2180
487k
    }
2181
1.39k
  }
2182
1.99k
  EFREE_IF(ImageInfo->file.list);
2183
1.99k
  ImageInfo->file.count = 0;
2184
1.99k
}
2185
/* }}} */
2186
2187
526k
static image_info_data *exif_alloc_image_info_data(image_info_list *info_list) {
2188
526k
  if (info_list->count == info_list->alloc_count) {
2189
13.4k
    int new_alloc_count = info_list->alloc_count ? info_list->alloc_count * 2 : 1;
2190
13.4k
    info_list->list = safe_erealloc(
2191
13.4k
      info_list->list, new_alloc_count, sizeof(image_info_data), 0);
2192
13.4k
    info_list->alloc_count = new_alloc_count;
2193
13.4k
  }
2194
526k
  return &info_list->list[info_list->count++];
2195
526k
}
2196
2197
/* {{{ exif_iif_add_value
2198
 Add a value to image_info
2199
*/
2200
static void exif_iif_add_value(image_info_type *image_info, int section_index, const char *name, int tag, int format, size_t length, void* value, size_t value_len, int motorola_intel)
2201
518k
{
2202
518k
  size_t idex;
2203
518k
  void *vptr, *vptr_end;
2204
518k
  image_info_value *info_value;
2205
518k
  image_info_data  *info_data;
2206
2207
518k
  info_data = exif_alloc_image_info_data(&image_info->info_list[section_index]);
2208
518k
  memset(info_data, 0, sizeof(image_info_data));
2209
518k
  info_data->tag    = tag;
2210
518k
  info_data->format = format;
2211
518k
  info_data->length = length;
2212
518k
  info_data->name   = estrdup(name);
2213
518k
  info_value        = &info_data->value;
2214
2215
518k
  switch (format) {
2216
436k
    case TAG_FMT_STRING:
2217
436k
      if (length > value_len) {
2218
0
        exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
2219
0
        value = NULL;
2220
0
      }
2221
436k
      if (value) {
2222
436k
        length = zend_strnlen(value, length);
2223
436k
        info_value->s = estrndup(value, length);
2224
436k
        info_data->length = length;
2225
436k
      } else {
2226
0
        info_data->length = 0;
2227
0
        info_value->s = estrdup("");
2228
0
      }
2229
436k
      break;
2230
2231
341
    default:
2232
      /* Standard says more types possible but skip them...
2233
       * but allow users to handle data if they know how to
2234
       * So not return but use type UNDEFINED
2235
       * return;
2236
       */
2237
341
      info_data->tag = TAG_FMT_UNDEFINED;/* otherwise not freed from memory */
2238
341
      ZEND_FALLTHROUGH;
2239
2.43k
    case TAG_FMT_SBYTE:
2240
50.2k
    case TAG_FMT_BYTE:
2241
    /* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
2242
50.2k
      if (!length) {
2243
16.5k
        break;
2244
16.5k
      }
2245
33.7k
      ZEND_FALLTHROUGH;
2246
34.3k
    case TAG_FMT_UNDEFINED:
2247
34.3k
      if (length > value_len) {
2248
0
        exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
2249
0
        value = NULL;
2250
0
      }
2251
34.3k
      if (value) {
2252
34.3k
        if (tag == TAG_MAKER_NOTE) {
2253
2.14k
          length = zend_strnlen(value, length);
2254
2.14k
        }
2255
2256
        /* do not recompute length here */
2257
34.3k
        info_value->s = estrndup(value, length);
2258
34.3k
        info_data->length = length;
2259
34.3k
      } else {
2260
0
        info_data->length = 0;
2261
0
        info_value->s = estrdup("");
2262
0
      }
2263
34.3k
      break;
2264
2265
2.39k
    case TAG_FMT_USHORT:
2266
4.29k
    case TAG_FMT_ULONG:
2267
5.18k
    case TAG_FMT_URATIONAL:
2268
8.61k
    case TAG_FMT_SSHORT:
2269
11.4k
    case TAG_FMT_SLONG:
2270
13.1k
    case TAG_FMT_SRATIONAL:
2271
28.2k
    case TAG_FMT_SINGLE:
2272
30.5k
    case TAG_FMT_DOUBLE:
2273
30.5k
      if (length==0) {
2274
1.53k
        break;
2275
1.53k
      }
2276
29.0k
      if (length>1) {
2277
21.8k
        info_value->list = safe_emalloc(length, sizeof(image_info_value), 0);
2278
21.8k
      } else {
2279
7.23k
        info_value = &info_data->value;
2280
7.23k
      }
2281
29.0k
      vptr_end = (char *) value + value_len;
2282
5.34M
      for (idex=0,vptr=value; idex<length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
2283
5.31M
        if ((char *) vptr_end - (char *) vptr < php_tiff_bytes_per_format[format]) {
2284
0
          exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
2285
0
          break;
2286
0
        }
2287
5.31M
        if (length>1) {
2288
5.31M
          info_value = &info_data->value.list[idex];
2289
5.31M
        }
2290
5.31M
        switch (format) {
2291
3.80M
          case TAG_FMT_USHORT:
2292
3.80M
            info_value->u = php_ifd_get16u(vptr, motorola_intel);
2293
3.80M
            break;
2294
2295
50.5k
          case TAG_FMT_ULONG:
2296
50.5k
            info_value->u = php_ifd_get32u(vptr, motorola_intel);
2297
50.5k
            break;
2298
2299
52.7k
          case TAG_FMT_URATIONAL:
2300
52.7k
            info_value->ur.num = php_ifd_get32u(vptr, motorola_intel);
2301
52.7k
            info_value->ur.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
2302
52.7k
            break;
2303
2304
288k
          case TAG_FMT_SSHORT:
2305
288k
            info_value->i = php_ifd_get16s(vptr, motorola_intel);
2306
288k
            break;
2307
2308
538k
          case TAG_FMT_SLONG:
2309
538k
            info_value->i = php_ifd_get32s(vptr, motorola_intel);
2310
538k
            break;
2311
2312
223k
          case TAG_FMT_SRATIONAL:
2313
223k
            info_value->sr.num = php_ifd_get32u(vptr, motorola_intel);
2314
223k
            info_value->sr.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
2315
223k
            break;
2316
2317
278k
          case TAG_FMT_SINGLE:
2318
#ifdef EXIF_DEBUG
2319
            php_error_docref(NULL, E_WARNING, "Found value of type single");
2320
#endif
2321
278k
            info_value->f = php_ifd_get_float(value);
2322
278k
            break;
2323
79.6k
          case TAG_FMT_DOUBLE:
2324
#ifdef EXIF_DEBUG
2325
            php_error_docref(NULL, E_WARNING, "Found value of type double");
2326
#endif
2327
79.6k
            info_value->d = php_ifd_get_double(value);
2328
79.6k
            break;
2329
5.31M
        }
2330
5.31M
      }
2331
518k
  }
2332
518k
  image_info->sections_found |= 1<<section_index;
2333
518k
}
2334
/* }}} */
2335
2336
/* {{{ exif_iif_add_tag
2337
 Add a tag from IFD to image_info
2338
*/
2339
static void exif_iif_add_tag(image_info_type *image_info, int section_index, const char *name, int tag, int format, size_t length, void* value, size_t value_len)
2340
518k
{
2341
518k
  exif_iif_add_value(image_info, section_index, name, tag, format, length, value, value_len, image_info->motorola_intel);
2342
518k
}
2343
/* }}} */
2344
2345
/* {{{ exif_iif_add_int
2346
 Add an int value to image_info
2347
*/
2348
static void exif_iif_add_int(image_info_type *image_info, int section_index, const char *name, int value)
2349
3.98k
{
2350
3.98k
  image_info_data *info_data = exif_alloc_image_info_data(&image_info->info_list[section_index]);
2351
3.98k
  info_data->tag    = TAG_NONE;
2352
3.98k
  info_data->format = TAG_FMT_SLONG;
2353
3.98k
  info_data->length = 1;
2354
3.98k
  info_data->name   = estrdup(name);
2355
3.98k
  info_data->value.i = value;
2356
3.98k
  image_info->sections_found |= 1<<section_index;
2357
3.98k
}
2358
/* }}} */
2359
2360
/* {{{ exif_iif_add_str
2361
 Add a string value to image_info MUST BE NUL TERMINATED
2362
*/
2363
static void exif_iif_add_str(image_info_type *image_info, int section_index, const char *name, const char *value)
2364
7.29k
{
2365
7.29k
  if (value) {
2366
3.99k
    image_info_data *info_data =
2367
3.99k
      exif_alloc_image_info_data(&image_info->info_list[section_index]);
2368
3.99k
    info_data->tag    = TAG_NONE;
2369
3.99k
    info_data->format = TAG_FMT_STRING;
2370
3.99k
    info_data->length = 1;
2371
3.99k
    info_data->name   = estrdup(name);
2372
3.99k
    info_data->value.s = estrdup(value);
2373
3.99k
    image_info->sections_found |= 1<<section_index;
2374
3.99k
  }
2375
7.29k
}
2376
/* }}} */
2377
2378
/* {{{ exif_iif_add_fmt
2379
 Add a format string value to image_info MUST BE NUL TERMINATED
2380
*/
2381
static void exif_iif_add_fmt(image_info_type *image_info, int section_index, const char *name, char *value, ...)
2382
245
{
2383
245
  char             *tmp;
2384
245
  va_list      arglist;
2385
2386
245
  va_start(arglist, value);
2387
245
  if (value) {
2388
245
    vspprintf(&tmp, 0, value, arglist);
2389
245
    exif_iif_add_str(image_info, section_index, name, tmp);
2390
245
    efree(tmp);
2391
245
  }
2392
245
  va_end(arglist);
2393
245
}
2394
/* }}} */
2395
2396
/* {{{ exif_iif_add_str
2397
 Add a string value to image_info MUST BE NUL TERMINATED
2398
*/
2399
static void exif_iif_add_buffer(image_info_type *image_info, int section_index, const char *name, int length, const char *value)
2400
100
{
2401
100
  if (value) {
2402
100
    image_info_data *info_data =
2403
100
      exif_alloc_image_info_data(&image_info->info_list[section_index]);
2404
100
    info_data->tag    = TAG_NONE;
2405
100
    info_data->format = TAG_FMT_UNDEFINED;
2406
100
    info_data->length = length;
2407
100
    info_data->name   = estrdup(name);
2408
100
    info_data->value.s = safe_emalloc(length, 1, 1);
2409
100
    memcpy(info_data->value.s, value, length);
2410
100
    info_data->value.s[length] = 0;
2411
100
    image_info->sections_found |= 1<<section_index;
2412
100
  }
2413
100
}
2414
/* }}} */
2415
2416
/* {{{ exif_iif_free
2417
 Free memory allocated for image_info
2418
*/
2419
27.8k
static void exif_iif_free(image_info_type *image_info, int section_index) {
2420
27.8k
  void *f; /* faster */
2421
2422
27.8k
  if (image_info->info_list[section_index].count) {
2423
529k
    for (int i = 0; i < image_info->info_list[section_index].count; i++) {
2424
526k
      if ((f=image_info->info_list[section_index].list[i].name) != NULL) {
2425
526k
        efree(f);
2426
526k
      }
2427
526k
      switch(image_info->info_list[section_index].list[i].format) {
2428
708
        case TAG_FMT_UNDEFINED:
2429
441k
        case TAG_FMT_STRING:
2430
443k
        case TAG_FMT_SBYTE:
2431
491k
        case TAG_FMT_BYTE:
2432
491k
        default:
2433
491k
          if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
2434
475k
            efree(f);
2435
475k
          }
2436
491k
          break;
2437
2438
2.39k
        case TAG_FMT_USHORT:
2439
4.29k
        case TAG_FMT_ULONG:
2440
5.18k
        case TAG_FMT_URATIONAL:
2441
8.61k
        case TAG_FMT_SSHORT:
2442
15.4k
        case TAG_FMT_SLONG:
2443
17.1k
        case TAG_FMT_SRATIONAL:
2444
32.2k
        case TAG_FMT_SINGLE:
2445
34.5k
        case TAG_FMT_DOUBLE:
2446
          /* nothing to do here */
2447
34.5k
          if (image_info->info_list[section_index].list[i].length > 1) {
2448
21.8k
            if ((f=image_info->info_list[section_index].list[i].value.list) != NULL) {
2449
21.8k
              efree(f);
2450
21.8k
            }
2451
21.8k
          }
2452
34.5k
          break;
2453
526k
      }
2454
526k
    }
2455
3.43k
  }
2456
27.8k
  EFREE_IF(image_info->info_list[section_index].list);
2457
27.8k
}
2458
/* }}} */
2459
2460
/* {{{ add_assoc_image_info
2461
 * Add image_info to associative array value. */
2462
static void add_assoc_image_info(zval *value, int sub_array, image_info_type *image_info, int section_index)
2463
10.1k
{
2464
10.1k
  int idx = 0, unknown = 0;
2465
2466
10.1k
  if (!image_info->info_list[section_index].count) {
2467
7.32k
    return;
2468
7.32k
  }
2469
2470
2.85k
  zval tmpi;
2471
2.85k
  if (sub_array) {
2472
1.11k
    array_init(&tmpi);
2473
1.74k
  } else {
2474
1.74k
    ZVAL_COPY_VALUE(&tmpi, value);
2475
1.74k
  }
2476
2477
315k
  for (int i = 0; i<image_info->info_list[section_index].count; i++) {
2478
312k
    image_info_data *info_data = &image_info->info_list[section_index].list[i];
2479
312k
    image_info_value *info_value = &info_data->value;
2480
312k
    const char *name = info_data->name;
2481
312k
    char uname[64];
2482
2483
312k
    if (!name) {
2484
0
      snprintf(uname, sizeof(uname), "%d", unknown++);
2485
0
      name = uname;
2486
0
    }
2487
2488
312k
    if (info_data->length == 0) {
2489
11.9k
      add_assoc_null(&tmpi, name);
2490
300k
    } else {
2491
300k
      switch (info_data->format) {
2492
251
        default:
2493
          /* Standard says more types possible but skip them...
2494
           * but allow users to handle data if they know how to
2495
           * So not return but use type UNDEFINED
2496
           * return;
2497
           */
2498
25.3k
        case TAG_FMT_BYTE:
2499
27.3k
        case TAG_FMT_SBYTE:
2500
27.8k
        case TAG_FMT_UNDEFINED:
2501
27.8k
          if (!info_value->s) {
2502
0
            add_assoc_stringl(&tmpi, name, "", 0);
2503
27.8k
          } else {
2504
27.8k
            add_assoc_stringl(&tmpi, name, info_value->s, info_data->length);
2505
27.8k
          }
2506
27.8k
          break;
2507
2508
241k
        case TAG_FMT_STRING: {
2509
241k
          const char *val = info_value->s ? info_value->s : "";
2510
241k
          if (section_index==SECTION_COMMENT) {
2511
235k
            add_index_string(&tmpi, idx++, val);
2512
235k
          } else {
2513
5.41k
            add_assoc_string(&tmpi, name, val);
2514
5.41k
          }
2515
241k
          break;
2516
27.3k
        }
2517
2518
552
        case TAG_FMT_URATIONAL:
2519
1.98k
        case TAG_FMT_SRATIONAL:
2520
4.03k
        case TAG_FMT_USHORT:
2521
7.11k
        case TAG_FMT_SSHORT:
2522
22.0k
        case TAG_FMT_SINGLE:
2523
24.0k
        case TAG_FMT_DOUBLE:
2524
25.3k
        case TAG_FMT_ULONG:
2525
31.8k
        case TAG_FMT_SLONG: {
2526
          /* now the rest, first see if it becomes an array */
2527
31.8k
          zval array;
2528
31.8k
          int l = info_data->length;
2529
31.8k
          if (l > 1) {
2530
21.3k
            array_init(&array);
2531
21.3k
          }
2532
5.27M
          for (int ap = 0; ap < l; ap++) {
2533
5.23M
            char buffer[64];
2534
5.23M
            if (l>1) {
2535
5.22M
              info_value = &info_data->value.list[ap];
2536
5.22M
            }
2537
5.23M
            switch (info_data->format) {
2538
0
              case TAG_FMT_BYTE:
2539
0
                if (l>1) {
2540
0
                  info_value = &info_data->value;
2541
0
                  for (int b = 0; b < l; b++) {
2542
0
                    add_index_long(&array, b, (int)(info_value->s[b]));
2543
0
                  }
2544
0
                  break;
2545
0
                }
2546
0
                ZEND_FALLTHROUGH;
2547
3.75M
              case TAG_FMT_USHORT:
2548
3.80M
              case TAG_FMT_ULONG:
2549
3.80M
                if (l==1) {
2550
2.00k
                  add_assoc_long(&tmpi, name, (int)info_value->u);
2551
3.80M
                } else {
2552
3.80M
                  add_index_long(&array, ap, (int)info_value->u);
2553
3.80M
                }
2554
3.80M
                break;
2555
2556
50.6k
              case TAG_FMT_URATIONAL:
2557
50.6k
                snprintf(buffer, sizeof(buffer), "%u/%u", info_value->ur.num, info_value->ur.den);
2558
50.6k
                if (l==1) {
2559
177
                  add_assoc_string(&tmpi, name, buffer);
2560
50.4k
                } else {
2561
50.4k
                  add_index_string(&array, ap, buffer);
2562
50.4k
                }
2563
50.6k
                break;
2564
2565
0
              case TAG_FMT_SBYTE:
2566
0
                if (l>1) {
2567
0
                  info_value = &info_data->value;
2568
0
                  for (int b = 0; b < l; b++) {
2569
0
                    add_index_long(&array, ap, (int)info_value->s[b]);
2570
0
                  }
2571
0
                  break;
2572
0
                }
2573
0
                ZEND_FALLTHROUGH;
2574
258k
              case TAG_FMT_SSHORT:
2575
801k
              case TAG_FMT_SLONG:
2576
801k
                if (l==1) {
2577
6.58k
                  add_assoc_long(&tmpi, name, info_value->i);
2578
794k
                } else {
2579
794k
                  add_index_long(&array, ap, info_value->i);
2580
794k
                }
2581
801k
                break;
2582
2583
222k
              case TAG_FMT_SRATIONAL:
2584
222k
                snprintf(buffer, sizeof(buffer), "%i/%i", info_value->sr.num, info_value->sr.den);
2585
222k
                if (l==1) {
2586
645
                  add_assoc_string(&tmpi, name, buffer);
2587
222k
                } else {
2588
222k
                  add_index_string(&array, ap, buffer);
2589
222k
                }
2590
222k
                break;
2591
2592
278k
              case TAG_FMT_SINGLE:
2593
278k
                if (l==1) {
2594
633
                  add_assoc_double(&tmpi, name, info_value->f);
2595
277k
                } else {
2596
277k
                  add_index_double(&array, ap, info_value->f);
2597
277k
                }
2598
278k
                break;
2599
2600
78.4k
              case TAG_FMT_DOUBLE:
2601
78.4k
                if (l==1) {
2602
396
                  add_assoc_double(&tmpi, name, info_value->d);
2603
78.0k
                } else {
2604
78.0k
                  add_index_double(&array, ap, info_value->d);
2605
78.0k
                }
2606
78.4k
                break;
2607
5.23M
            }
2608
5.23M
          }
2609
31.8k
          if (l > 1) {
2610
21.3k
            add_assoc_zval(&tmpi, name, &array);
2611
21.3k
          }
2612
31.8k
          break;
2613
31.8k
        }
2614
300k
      }
2615
300k
    }
2616
312k
  }
2617
2.85k
  if (sub_array) {
2618
1.11k
    add_assoc_zval(value, exif_get_sectionname(section_index), &tmpi);
2619
1.11k
  }
2620
2.85k
}
2621
/* }}} */
2622
2623
/* {{{ Markers
2624
   JPEG markers consist of one or more 0xFF bytes, followed by a marker
2625
   code byte (which is not an FF).  Here are the marker codes of interest
2626
   in this program.  (See jdmarker.c for a more complete list.)
2627
*/
2628
2629
#define M_TEM   0x01    /* temp for arithmetic coding              */
2630
#define M_RES   0x02    /* reserved                                */
2631
260
#define M_SOF0  0xC0    /* Start Of Frame N                        */
2632
550
#define M_SOF1  0xC1    /* N indicates which compression process   */
2633
747
#define M_SOF2  0xC2    /* Only SOF0-SOF2 are now in common use    */
2634
933
#define M_SOF3  0xC3
2635
#define M_DHT   0xC4
2636
1.08k
#define M_SOF5  0xC5    /* NB: codes C4 and CC are NOT SOF markers */
2637
1.76k
#define M_SOF6  0xC6
2638
1.96k
#define M_SOF7  0xC7
2639
#define M_JPEG  0x08    /* reserved for extensions                 */
2640
2.32k
#define M_SOF9  0xC9
2641
2.58k
#define M_SOF10 0xCA
2642
2.77k
#define M_SOF11 0xCB
2643
#define M_DAC   0xCC    /* arithmetic table                         */
2644
2.96k
#define M_SOF13 0xCD
2645
3.20k
#define M_SOF14 0xCE
2646
3.39k
#define M_SOF15 0xCF
2647
#define M_RST0  0xD0    /* restart segment                          */
2648
#define M_RST1  0xD1
2649
#define M_RST2  0xD2
2650
#define M_RST3  0xD3
2651
#define M_RST4  0xD4
2652
#define M_RST5  0xD5
2653
#define M_RST6  0xD6
2654
#define M_RST7  0xD7
2655
451
#define M_SOI   0xD8    /* Start Of Image (beginning of datastream) */
2656
59
#define M_EOI   0xD9    /* End Of Image (end of datastream)         */
2657
4
#define M_SOS   0xDA    /* Start Of Scan (begins compressed data)   */
2658
#define M_DQT   0xDB
2659
#define M_DNL   0xDC
2660
#define M_DRI   0xDD
2661
#define M_DHP   0xDE
2662
#define M_EXP   0xDF
2663
#define M_APP0  0xE0    /* JPEG: 'JFIFF' AND (additional 'JFXX')    */
2664
3.15k
#define M_EXIF  0xE1    /* Exif Attribute Information               */
2665
#define M_APP2  0xE2    /* Flash Pix Extension Data?                */
2666
#define M_APP3  0xE3
2667
#define M_APP4  0xE4
2668
#define M_APP5  0xE5
2669
#define M_APP6  0xE6
2670
#define M_APP7  0xE7
2671
#define M_APP8  0xE8
2672
#define M_APP9  0xE9
2673
#define M_APP10 0xEA
2674
#define M_APP11 0xEB
2675
731
#define M_APP12 0xEC
2676
#define M_APP13 0xED    /* IPTC International Press Telecommunications Council */
2677
#define M_APP14 0xEE    /* Software, Copyright?                     */
2678
#define M_APP15 0xEF
2679
#define M_JPG0  0xF0
2680
#define M_JPG1  0xF1
2681
#define M_JPG2  0xF2
2682
#define M_JPG3  0xF3
2683
#define M_JPG4  0xF4
2684
#define M_JPG5  0xF5
2685
#define M_JPG6  0xF6
2686
#define M_JPG7  0xF7
2687
#define M_JPG8  0xF8
2688
#define M_JPG9  0xF9
2689
#define M_JPG10 0xFA
2690
#define M_JPG11 0xFB
2691
#define M_JPG12 0xFC
2692
#define M_JPG13 0xFD
2693
4.01M
#define M_COM   0xFE    /* COMment                                  */
2694
2695
45.5k
#define M_PSEUDO 0x123  /* Extra value.                             */
2696
/* }}} */
2697
2698
/* {{{ exif_process_COM
2699
   Process a COM marker.
2700
   We want to print out the marker contents as legible text;
2701
   we must guard against random junk and varying newline representations.
2702
*/
2703
static void exif_process_COM (image_info_type *image_info, char *value, size_t length)
2704
434k
{
2705
434k
  exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2, length-2);
2706
434k
}
2707
/* }}} */
2708
2709
/* {{{ exif_process_SOFn
2710
 * Process a SOFn marker.  This is useful for the image dimensions */
2711
static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
2712
3.38k
{
2713
  /* 0xFF SOSn SectLen(2) Bits(1) Height(2) Width(2) Channels(1)  3*Channels (1)  */
2714
3.38k
  result->bits_per_sample = Data[2];
2715
3.38k
  result->height          = php_jpg_get16(Data+3);
2716
3.38k
  result->width           = php_jpg_get16(Data+5);
2717
3.38k
  result->num_components  = Data[7];
2718
3.38k
}
2719
/* }}} */
2720
2721
/* forward declarations */
2722
static bool exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, const exif_offset_info *info, size_t displacement, int section_index, int tag);
2723
static bool exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, const exif_offset_info *info, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table);
2724
static bool exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index);
2725
2726
/* {{{ exif_get_markername
2727
  Get name of marker */
2728
#ifdef EXIF_DEBUG
2729
static char * exif_get_markername(int marker)
2730
{
2731
  switch(marker) {
2732
    case 0xC0: return "SOF0";
2733
    case 0xC1: return "SOF1";
2734
    case 0xC2: return "SOF2";
2735
    case 0xC3: return "SOF3";
2736
    case 0xC4: return "DHT";
2737
    case 0xC5: return "SOF5";
2738
    case 0xC6: return "SOF6";
2739
    case 0xC7: return "SOF7";
2740
    case 0xC9: return "SOF9";
2741
    case 0xCA: return "SOF10";
2742
    case 0xCB: return "SOF11";
2743
    case 0xCD: return "SOF13";
2744
    case 0xCE: return "SOF14";
2745
    case 0xCF: return "SOF15";
2746
    case 0xD8: return "SOI";
2747
    case 0xD9: return "EOI";
2748
    case 0xDA: return "SOS";
2749
    case 0xDB: return "DQT";
2750
    case 0xDC: return "DNL";
2751
    case 0xDD: return "DRI";
2752
    case 0xDE: return "DHP";
2753
    case 0xDF: return "EXP";
2754
    case 0xE0: return "APP0";
2755
    case 0xE1: return "EXIF";
2756
    case 0xE2: return "FPIX";
2757
    case 0xE3: return "APP3";
2758
    case 0xE4: return "APP4";
2759
    case 0xE5: return "APP5";
2760
    case 0xE6: return "APP6";
2761
    case 0xE7: return "APP7";
2762
    case 0xE8: return "APP8";
2763
    case 0xE9: return "APP9";
2764
    case 0xEA: return "APP10";
2765
    case 0xEB: return "APP11";
2766
    case 0xEC: return "APP12";
2767
    case 0xED: return "APP13";
2768
    case 0xEE: return "APP14";
2769
    case 0xEF: return "APP15";
2770
    case 0xF0: return "JPG0";
2771
    case 0xFD: return "JPG13";
2772
    case 0xFE: return "COM";
2773
    case 0x01: return "TEM";
2774
  }
2775
  return "Unknown";
2776
}
2777
#endif
2778
/* }}} */
2779
2780
/* {{{ Get headername for index or false if not defined */
2781
PHP_FUNCTION(exif_tagname)
2782
0
{
2783
0
  zend_long tag;
2784
0
  char *szTemp;
2785
2786
0
  if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &tag) == FAILURE) {
2787
0
    RETURN_THROWS();
2788
0
  }
2789
2790
0
  szTemp = exif_get_tagname(tag, tag_table_IFD);
2791
0
  if (tag < 0 || !szTemp) {
2792
0
    RETURN_FALSE;
2793
0
  }
2794
2795
0
  RETURN_STRING(szTemp);
2796
0
}
2797
/* }}} */
2798
2799
/* {{{ exif_ifd_make_value
2800
 * Create a value for an ifd from an info_data pointer */
2801
0
static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel) {
2802
0
  size_t  byte_count;
2803
0
  char    *value_ptr;
2804
2805
0
  image_info_value  *info_value;
2806
2807
0
  byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2808
0
  value_ptr = safe_emalloc(max(byte_count, 4), 1, 0);
2809
0
  memset(value_ptr, 0, 4);
2810
0
  if (!info_data->length) {
2811
0
    return value_ptr;
2812
0
  }
2813
0
  if (info_data->format == TAG_FMT_UNDEFINED || info_data->format == TAG_FMT_STRING
2814
0
    || (byte_count>1 && (info_data->format == TAG_FMT_BYTE || info_data->format == TAG_FMT_SBYTE))
2815
0
  ) {
2816
0
    memcpy(value_ptr, info_data->value.s, byte_count);
2817
0
    return value_ptr;
2818
0
  } else if (info_data->format == TAG_FMT_BYTE) {
2819
0
    *value_ptr = info_data->value.u;
2820
0
    return value_ptr;
2821
0
  } else if (info_data->format == TAG_FMT_SBYTE) {
2822
0
    *value_ptr = info_data->value.i;
2823
0
    return value_ptr;
2824
0
  } else {
2825
0
    char *data_ptr = value_ptr;
2826
0
    for(size_t i = 0; i < info_data->length; i++) {
2827
0
      if (info_data->length==1) {
2828
0
        info_value = &info_data->value;
2829
0
      } else {
2830
0
        info_value = &info_data->value.list[i];
2831
0
      }
2832
0
      switch(info_data->format) {
2833
0
        case TAG_FMT_USHORT:
2834
0
          php_ifd_set16u(data_ptr, info_value->u, motorola_intel);
2835
0
          data_ptr += 2;
2836
0
          break;
2837
0
        case TAG_FMT_ULONG:
2838
0
          php_ifd_set32u(data_ptr, info_value->u, motorola_intel);
2839
0
          data_ptr += 4;
2840
0
          break;
2841
0
        case TAG_FMT_SSHORT:
2842
0
          php_ifd_set16u(data_ptr, info_value->i, motorola_intel);
2843
0
          data_ptr += 2;
2844
0
          break;
2845
0
        case TAG_FMT_SLONG:
2846
0
          php_ifd_set32u(data_ptr, info_value->i, motorola_intel);
2847
0
          data_ptr += 4;
2848
0
          break;
2849
0
        case TAG_FMT_URATIONAL:
2850
0
          php_ifd_set32u(data_ptr,   info_value->sr.num, motorola_intel);
2851
0
          php_ifd_set32u(data_ptr+4, info_value->sr.den, motorola_intel);
2852
0
          data_ptr += 8;
2853
0
          break;
2854
0
        case TAG_FMT_SRATIONAL:
2855
0
          php_ifd_set32u(data_ptr,   info_value->ur.num, motorola_intel);
2856
0
          php_ifd_set32u(data_ptr+4, info_value->ur.den, motorola_intel);
2857
0
          data_ptr += 8;
2858
0
          break;
2859
0
        case TAG_FMT_SINGLE:
2860
0
          memcpy(data_ptr, &info_value->f, 4);
2861
0
          data_ptr += 4;
2862
0
          break;
2863
0
        case TAG_FMT_DOUBLE:
2864
0
          memcpy(data_ptr, &info_value->d, 8);
2865
0
          data_ptr += 8;
2866
0
          break;
2867
0
      }
2868
0
    }
2869
0
  }
2870
0
  return value_ptr;
2871
0
}
2872
/* }}} */
2873
2874
/* {{{ exif_thumbnail_build
2875
 * Check and build thumbnail */
2876
0
static void exif_thumbnail_build(image_info_type *ImageInfo) {
2877
0
  size_t            new_size, new_move, new_value;
2878
0
  char              *new_data;
2879
0
  void              *value_ptr;
2880
0
  int               i, byte_count;
2881
0
  image_info_list   *info_list;
2882
0
  image_info_data   *info_data;
2883
2884
0
  if (!ImageInfo->read_thumbnail || !ImageInfo->Thumbnail.offset || !ImageInfo->Thumbnail.size) {
2885
0
    return; /* ignore this call */
2886
0
  }
2887
#ifdef EXIF_DEBUG
2888
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: filetype = %d", ImageInfo->Thumbnail.filetype);
2889
#endif
2890
0
  switch(ImageInfo->Thumbnail.filetype) {
2891
0
    default:
2892
0
    case IMAGE_FILETYPE_JPEG:
2893
      /* done */
2894
0
      break;
2895
0
    case IMAGE_FILETYPE_TIFF_II:
2896
0
    case IMAGE_FILETYPE_TIFF_MM:
2897
0
      info_list = &ImageInfo->info_list[SECTION_THUMBNAIL];
2898
0
      new_size  = 8 + 2 + info_list->count * 12 + 4;
2899
#ifdef EXIF_DEBUG
2900
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size of signature + directory(%d): 0x%02X", info_list->count, new_size);
2901
#endif
2902
0
      new_value= new_size; /* offset for ifd values outside ifd directory */
2903
0
      for (i=0; i<info_list->count; i++) {
2904
0
        info_data  = &info_list->list[i];
2905
0
        byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2906
0
        if (byte_count > 4) {
2907
0
          new_size += byte_count;
2908
0
        }
2909
0
      }
2910
0
      new_move = new_size;
2911
0
      new_data = safe_erealloc(ImageInfo->Thumbnail.data, 1, ImageInfo->Thumbnail.size, new_size);
2912
0
      ImageInfo->Thumbnail.data = new_data;
2913
0
      memmove(ImageInfo->Thumbnail.data + new_move, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
2914
0
      ImageInfo->Thumbnail.size += new_size;
2915
      /* fill in data */
2916
0
      if (ImageInfo->motorola_intel) {
2917
0
        memcpy(new_data, "MM\x00\x2a\x00\x00\x00\x08", 8);
2918
0
      } else {
2919
0
        memcpy(new_data, "II\x2a\x00\x08\x00\x00\x00", 8);
2920
0
      }
2921
0
      new_data += 8;
2922
0
      php_ifd_set16u(new_data, info_list->count, ImageInfo->motorola_intel);
2923
0
      new_data += 2;
2924
0
      for (i=0; i<info_list->count; i++) {
2925
0
        info_data  = &info_list->list[i];
2926
0
        byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2927
#ifdef EXIF_DEBUG
2928
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process tag(x%04X=%s): %s%s (%d bytes)", info_data->tag, exif_get_tagname_debug(info_data->tag, tag_table_IFD), (info_data->length>1)&&info_data->format!=TAG_FMT_UNDEFINED&&info_data->format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(info_data->format), byte_count);
2929
#endif
2930
0
        if (info_data->tag==TAG_STRIP_OFFSETS || info_data->tag==TAG_JPEG_INTERCHANGE_FORMAT) {
2931
0
          php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2932
0
          php_ifd_set16u(new_data + 2, TAG_FMT_ULONG,     ImageInfo->motorola_intel);
2933
0
          php_ifd_set32u(new_data + 4, 1,                 ImageInfo->motorola_intel);
2934
0
          php_ifd_set32u(new_data + 8, new_move,          ImageInfo->motorola_intel);
2935
0
        } else {
2936
0
          php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2937
0
          php_ifd_set16u(new_data + 2, info_data->format, ImageInfo->motorola_intel);
2938
0
          php_ifd_set32u(new_data + 4, info_data->length, ImageInfo->motorola_intel);
2939
0
          value_ptr  = exif_ifd_make_value(info_data, ImageInfo->motorola_intel);
2940
0
          if (byte_count <= 4) {
2941
0
            memmove(new_data+8, value_ptr, 4);
2942
0
          } else {
2943
0
            php_ifd_set32u(new_data+8, new_value, ImageInfo->motorola_intel);
2944
#ifdef EXIF_DEBUG
2945
            exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: writing with value offset: 0x%04X + 0x%02X", new_value, byte_count);
2946
#endif
2947
0
            memmove(ImageInfo->Thumbnail.data+new_value, value_ptr, byte_count);
2948
0
            new_value += byte_count;
2949
0
          }
2950
0
          efree(value_ptr);
2951
0
        }
2952
0
        new_data += 12;
2953
0
      }
2954
0
      memset(new_data, 0, 4); /* next ifd pointer */
2955
#ifdef EXIF_DEBUG
2956
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: created");
2957
#endif
2958
0
      break;
2959
0
  }
2960
0
}
2961
/* }}} */
2962
2963
/* {{{ exif_thumbnail_extract
2964
 * Grab the thumbnail, corrected */
2965
0
static void exif_thumbnail_extract(image_info_type *ImageInfo, const exif_offset_info *info) {
2966
0
  if (ImageInfo->Thumbnail.data) {
2967
0
    exif_error_docref("exif_read_data#error_mult_thumb" EXIFERR_CC, ImageInfo, E_WARNING, "Multiple possible thumbnails");
2968
0
    return; /* Should not happen */
2969
0
  }
2970
0
  if (!ImageInfo->read_thumbnail) {
2971
0
    return; /* ignore this call */
2972
0
  }
2973
  /* according to exif2.1, the thumbnail is not supposed to be greater than 64K */
2974
0
  if (ImageInfo->Thumbnail.size >= 65536
2975
0
   || ImageInfo->Thumbnail.size <= 0
2976
0
   || ImageInfo->Thumbnail.offset <= 0
2977
0
  ) {
2978
0
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Illegal thumbnail size/offset");
2979
0
    return;
2980
0
  }
2981
  /* Check to make sure we are not going to go past the ExifLength */
2982
0
  char *thumbnail = exif_offset_info_try_get(
2983
0
    info, ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
2984
0
  if (!thumbnail) {
2985
0
    EXIF_ERRLOG_THUMBEOF(ImageInfo)
2986
0
    return;
2987
0
  }
2988
0
  ImageInfo->Thumbnail.data = estrndup(thumbnail, ImageInfo->Thumbnail.size);
2989
0
  exif_thumbnail_build(ImageInfo);
2990
0
}
2991
/* }}} */
2992
2993
/* {{{ exif_process_undefined
2994
 * Copy a string/buffer in Exif header to a character string and return length of allocated buffer if any. */
2995
464
static int exif_process_undefined(char **result, const char *value, size_t byte_count) {
2996
  /* we cannot use strlcpy - here the problem is that we have to copy NUL
2997
   * chars up to byte_count, we also have to add a single NUL character to
2998
   * force end of string.
2999
   * estrndup does not return length
3000
   */
3001
464
  if (byte_count) {
3002
464
    (*result) = estrndup(value, byte_count); /* NULL @ byte_count!!! */
3003
464
    return byte_count+1;
3004
464
  }
3005
0
  return 0;
3006
464
}
3007
/* }}} */
3008
3009
/* {{{ exif_process_string_raw
3010
 * Copy a string in Exif header to a character string returns length of allocated buffer if any. */
3011
2.33k
static int exif_process_string_raw(char **result, const char *value, size_t byte_count) {
3012
  /* we cannot use strlcpy - here the problem is that we have to copy NUL
3013
   * chars up to byte_count, we also have to add a single NUL character to
3014
   * force end of string.
3015
   */
3016
2.33k
  if (byte_count) {
3017
2.00k
    (*result) = safe_emalloc(byte_count, 1, 1);
3018
2.00k
    memcpy(*result, value, byte_count);
3019
2.00k
    (*result)[byte_count] = '\0';
3020
2.00k
    return byte_count+1;
3021
2.00k
  }
3022
334
  return 0;
3023
2.33k
}
3024
/* }}} */
3025
3026
/* {{{ exif_process_string
3027
 * Copy a string in Exif header to a character string and return length of allocated buffer if any.
3028
 * In contrast to exif_process_string this function does always return a string buffer */
3029
1.02k
static int exif_process_string(char **result, const char *value, size_t byte_count) {
3030
  /* we cannot use strlcpy - here the problem is that we cannot use strlen to
3031
   * determine length of string and we cannot use strlcpy with len=byte_count+1
3032
   * because then we might get into an EXCEPTION if we exceed an allocated
3033
   * memory page...so we use zend_strnlen in conjunction with memcpy and add the NUL
3034
   * char.
3035
   * estrdup would sometimes allocate more memory and does not return length
3036
   */
3037
1.02k
  if ((byte_count=zend_strnlen(value, byte_count)) > 0) {
3038
464
    return exif_process_undefined(result, value, byte_count);
3039
464
  }
3040
560
  (*result) = estrndup("", 1); /* force empty string */
3041
560
  return byte_count+1;
3042
1.02k
}
3043
/* }}} */
3044
3045
/* {{{ exif_process_user_comment
3046
 * Process UserComment in IFD. */
3047
static int exif_process_user_comment(const image_info_type *ImageInfo, char **pszInfoPtr, char **pszEncoding, char *szValuePtr, int ByteCount)
3048
1.03k
{
3049
1.03k
  size_t len;
3050
3051
1.03k
  *pszEncoding = NULL;
3052
  /* Copy the comment */
3053
1.03k
  if (ByteCount>=8) {
3054
751
    const zend_encoding *from, *to;
3055
751
    if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
3056
7
      char  *decode;
3057
7
      *pszEncoding = estrdup(szValuePtr);
3058
7
      szValuePtr = szValuePtr+8;
3059
7
      ByteCount -= 8;
3060
      /* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
3061
       * since we have no encoding support for the BOM yet we skip that.
3062
       */
3063
7
      if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
3064
0
        decode = "UCS-2BE";
3065
0
        szValuePtr = szValuePtr+2;
3066
0
        ByteCount -= 2;
3067
7
      } else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
3068
0
        decode = "UCS-2LE";
3069
0
        szValuePtr = szValuePtr+2;
3070
0
        ByteCount -= 2;
3071
7
      } else if (ImageInfo->motorola_intel) {
3072
7
        decode = ImageInfo->decode_unicode_be;
3073
7
      } else {
3074
0
        decode = ImageInfo->decode_unicode_le;
3075
0
      }
3076
7
      to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode);
3077
7
      from = zend_multibyte_fetch_encoding(decode);
3078
      /* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
3079
7
      if (!to || !from || zend_multibyte_encoding_converter(
3080
0
          (unsigned char**)pszInfoPtr,
3081
0
          &len,
3082
0
          (unsigned char*)szValuePtr,
3083
0
          ByteCount,
3084
0
          to,
3085
7
          from) == (size_t)-1) {
3086
7
        len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
3087
7
      }
3088
7
      return len;
3089
744
    } else if (!memcmp(szValuePtr, "ASCII\0\0\0", 8)) {
3090
14
      *pszEncoding = estrdup(szValuePtr);
3091
14
      szValuePtr = szValuePtr+8;
3092
14
      ByteCount -= 8;
3093
730
    } else if (!memcmp(szValuePtr, "JIS\0\0\0\0\0", 8)) {
3094
      /* JIS should be translated to MB or we leave it to the user - leave it to the user */
3095
5
      *pszEncoding = estrdup(szValuePtr);
3096
5
      szValuePtr = szValuePtr+8;
3097
5
      ByteCount -= 8;
3098
      /* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
3099
5
      to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis);
3100
5
      from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le);
3101
5
      if (!to || !from || zend_multibyte_encoding_converter(
3102
0
          (unsigned char**)pszInfoPtr,
3103
0
          &len,
3104
0
          (unsigned char*)szValuePtr,
3105
0
          ByteCount,
3106
0
          to,
3107
5
          from) == (size_t)-1) {
3108
5
        len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
3109
5
      }
3110
5
      return len;
3111
725
    } else if (!memcmp(szValuePtr, "\0\0\0\0\0\0\0\0", 8)) {
3112
      /* 8 NULL means undefined and should be ASCII... */
3113
255
      *pszEncoding = estrdup("UNDEFINED");
3114
255
      szValuePtr = szValuePtr+8;
3115
255
      ByteCount -= 8;
3116
255
    }
3117
751
  }
3118
3119
  /* Olympus has this padded with trailing spaces.  Remove these first. */
3120
1.02k
  if (ByteCount>0) {
3121
4.32k
    for (int a = ByteCount-1; a && szValuePtr[a]==' '; a--) {
3122
3.58k
      (szValuePtr)[a] = '\0';
3123
3.58k
    }
3124
743
  }
3125
3126
  /* normal text without encoding */
3127
1.02k
  exif_process_string(pszInfoPtr, szValuePtr, ByteCount);
3128
1.02k
  return strlen(*pszInfoPtr);
3129
1.03k
}
3130
/* }}} */
3131
3132
/* {{{ exif_process_unicode
3133
 * Process unicode field in IFD. */
3134
static int exif_process_unicode(const image_info_type *ImageInfo, xp_field_type *xp_field, int tag, const char *szValuePtr, int ByteCount)
3135
2.32k
{
3136
2.32k
  xp_field->tag = tag;
3137
2.32k
  xp_field->value = NULL;
3138
  /* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
3139
2.32k
  if (zend_multibyte_encoding_converter(
3140
2.32k
      (unsigned char**)&xp_field->value,
3141
2.32k
      &xp_field->size,
3142
2.32k
      (const unsigned char*)szValuePtr,
3143
2.32k
      ByteCount,
3144
2.32k
      zend_multibyte_fetch_encoding(ImageInfo->encode_unicode),
3145
2.32k
      zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le)
3146
2.32k
      ) == (size_t)-1) {
3147
2.32k
    xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
3148
2.32k
  }
3149
2.32k
  return xp_field->size;
3150
2.32k
}
3151
/* }}} */
3152
3153
/* {{{ exif_process_IFD_in_MAKERNOTE
3154
 * Process nested IFDs directories in Maker Note. */
3155
static bool exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, const exif_offset_info *info, size_t displacement)
3156
3.30k
{
3157
3.30k
  int section_index = SECTION_MAKERNOTE;
3158
3.30k
  int NumDirEntries, old_motorola_intel;
3159
3.30k
  const maker_note_type *maker_note;
3160
3.30k
  char *dir_start;
3161
3.30k
  exif_offset_info new_info;
3162
3163
38.0k
  for (size_t i = 0; i <= sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
3164
38.0k
    if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
3165
#ifdef EXIF_DEBUG
3166
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, ImageInfo->make ? strlen(ImageInfo->make) : 0);
3167
#endif
3168
      /* unknown manufacturer, not an error, use it as a string */
3169
859
      return true;
3170
859
    }
3171
3172
37.2k
    maker_note = maker_note_array+i;
3173
3174
37.2k
    if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
3175
33.6k
      continue;
3176
3.50k
    if (maker_note->id_string && value_len >= maker_note->id_string_len
3177
1.89k
        && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
3178
1.05k
      continue;
3179
2.44k
    break;
3180
3.50k
  }
3181
3182
2.44k
  if (value_len < 2 || maker_note->offset >= value_len - 1) {
3183
    /* Do not go past the value end */
3184
195
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
3185
195
    return true;
3186
195
  }
3187
3188
2.25k
  if (UNEXPECTED(maker_note->tag_table == REQUIRES_CUSTOM_PARSING)) {
3189
    /* Custom parsing required, which is not implemented at this point
3190
     * Return true so that other metadata can still be parsed. */
3191
72
    return true;
3192
72
  }
3193
3194
2.17k
  dir_start = value_ptr + maker_note->offset;
3195
3196
#ifdef EXIF_DEBUG
3197
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s @0x%04X + 0x%04X=%d: %s", exif_get_sectionname(section_index), (intptr_t)dir_start-(intptr_t)info->offset_base+maker_note->offset+displacement, value_len, value_len, exif_char_dump(value_ptr, value_len, (intptr_t)dir_start-(intptr_t)info->offset_base+maker_note->offset+displacement));
3198
#endif
3199
3200
2.17k
  ImageInfo->sections_found |= FOUND_MAKERNOTE;
3201
3202
2.17k
  old_motorola_intel = ImageInfo->motorola_intel;
3203
2.17k
  switch (maker_note->byte_order) {
3204
720
    case MN_ORDER_INTEL:
3205
720
      ImageInfo->motorola_intel = 0;
3206
720
      break;
3207
328
    case MN_ORDER_MOTOROLA:
3208
328
      ImageInfo->motorola_intel = 1;
3209
328
      break;
3210
0
    default:
3211
1.13k
    case MN_ORDER_NORMAL:
3212
1.13k
      break;
3213
2.17k
  }
3214
3215
2.17k
  NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
3216
3217
  /* It can be that motorola_intel is wrongly mapped, let's try inverting it */
3218
2.17k
  if ((2+NumDirEntries*12) > value_len) {
3219
551
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianness, trying again with different endianness before imminent failure.");
3220
3221
551
    ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
3222
551
    NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
3223
551
  }
3224
3225
2.17k
  if ((2+NumDirEntries*12) > value_len) {
3226
246
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
3227
246
    return false;
3228
246
  }
3229
1.93k
  if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
3230
198
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
3231
198
    return false;
3232
198
  }
3233
3234
1.73k
  switch (maker_note->offset_mode) {
3235
438
    case MN_OFFSET_MAKER:
3236
438
      exif_offset_info_init(&new_info, value_ptr, value_ptr, value_len);
3237
438
      info = &new_info;
3238
438
      break;
3239
0
    default:
3240
1.29k
    case MN_OFFSET_NORMAL:
3241
1.29k
      break;
3242
1.73k
  }
3243
3244
3.43k
  for (int de = 0; de < NumDirEntries; de++) {
3245
2.55k
    size_t offset = 2 + 12 * de;
3246
2.55k
    if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
3247
2.55k
                  info, displacement, section_index, 0, maker_note->tag_table)) {
3248
859
      return false;
3249
859
    }
3250
2.55k
  }
3251
876
  ImageInfo->motorola_intel = old_motorola_intel;
3252
/*  NextDirOffset (must be NULL) = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);*/
3253
#ifdef EXIF_DEBUG
3254
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(SECTION_MAKERNOTE));
3255
#endif
3256
876
  return true;
3257
1.73k
}
3258
/* }}} */
3259
3260
24.2k
#define REQUIRE_NON_EMPTY() do { \
3261
24.2k
  if (byte_count == 0) { \
3262
1.09k
    EFREE_IF(outside); \
3263
1.09k
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname_debug(tag, tag_table)); \
3264
1.09k
    return false; \
3265
1.09k
  } \
3266
24.2k
} while (0)
3267
3268
3269
/* {{{ exif_process_IFD_TAG
3270
 * Process one of the nested IFDs directories. */
3271
static bool exif_process_IFD_TAG_impl(image_info_type *ImageInfo, char *dir_entry, const exif_offset_info *info, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
3272
92.9k
{
3273
92.9k
  unsigned int tag, format, components;
3274
92.9k
  char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
3275
92.9k
  size_t byte_count, offset_val;
3276
92.9k
  int64_t byte_count_signed;
3277
3278
92.9k
  tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
3279
92.9k
  format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
3280
92.9k
  components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
3281
3282
92.9k
  if (!format || format > NUM_FORMATS) {
3283
    /* (-1) catches illegal zero case as unsigned underflows to positive large. */
3284
55.7k
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal format code 0x%04X, suppose BYTE", tag, exif_get_tagname_debug(tag, tag_table), format);
3285
55.7k
    format = TAG_FMT_BYTE;
3286
55.7k
  }
3287
3288
92.9k
  byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];
3289
3290
92.9k
  if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
3291
2.19k
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count", tag, exif_get_tagname_debug(tag, tag_table));
3292
2.19k
    return false;
3293
2.19k
  }
3294
3295
90.7k
  byte_count = (size_t)byte_count_signed;
3296
3297
90.7k
  if (byte_count > 4) {
3298
    /* If its bigger than 4 bytes, the dir entry contains an offset. */
3299
48.9k
    offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3300
48.9k
    value_ptr = exif_offset_info_try_get(info, offset_val, byte_count);
3301
48.9k
    if (!value_ptr) {
3302
      /* It is important to check for IMAGE_FILETYPE_TIFF
3303
       * JPEG does not use absolute pointers instead its pointers are
3304
       * relative to the start of the TIFF header in APP1 section. */
3305
      // TODO: Shouldn't we also be taking "displacement" into account here?
3306
33.6k
      if (byte_count > ImageInfo->FileSize || offset_val>ImageInfo->FileSize-byte_count || (ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_II && ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_MM && ImageInfo->FileType!=IMAGE_FILETYPE_JPEG)) {
3307
4.99k
        exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X + x%04X = x%04X > x%04X)", tag, exif_get_tagname_debug(tag, tag_table), offset_val, byte_count, offset_val+byte_count, ImageInfo->FileSize);
3308
4.99k
        return false;
3309
4.99k
      }
3310
28.6k
      if (byte_count>sizeof(cbuf)) {
3311
        /* mark as outside range and get buffer */
3312
22.2k
        value_ptr = safe_emalloc(byte_count, 1, 0);
3313
22.2k
        outside = value_ptr;
3314
22.2k
      } else {
3315
        /* In most cases we only access a small range so
3316
         * it is faster to use a static buffer there
3317
         * BUT it offers also the possibility to have
3318
         * pointers read without the need to free them
3319
         * explicitly before returning. */
3320
6.35k
        memset(&cbuf, 0, sizeof(cbuf));
3321
6.35k
        value_ptr = cbuf;
3322
6.35k
      }
3323
3324
28.6k
      size_t fpos = php_stream_tell(ImageInfo->infile);
3325
28.6k
      php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
3326
28.6k
      size_t fgot = php_stream_tell(ImageInfo->infile);
3327
28.6k
      if (fgot!=displacement+offset_val) {
3328
0
        EFREE_IF(outside);
3329
0
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
3330
0
        return false;
3331
0
      }
3332
28.6k
      fgot = exif_read_from_stream_file_looped(ImageInfo->infile, value_ptr, byte_count);
3333
28.6k
      php_stream_seek(ImageInfo->infile, fpos, SEEK_SET);
3334
28.6k
      if (fgot != byte_count) {
3335
26
        EFREE_IF(outside);
3336
26
        EXIF_ERRLOG_FILEEOF(ImageInfo)
3337
26
        return false;
3338
26
      }
3339
28.6k
    }
3340
48.9k
  } else {
3341
    /* 4 bytes or less and value is in the dir entry itself */
3342
41.7k
    value_ptr = dir_entry+8;
3343
    // TODO: This is dubious, but the value is only used for debugging.
3344
41.7k
    offset_val = value_ptr-info->offset_base;
3345
41.7k
  }
3346
3347
85.7k
  ImageInfo->sections_found |= FOUND_ANY_TAG;
3348
#ifdef EXIF_DEBUG
3349
  int dump_free;
3350
  char *dump_data = exif_dump_data(&dump_free, format, components, ImageInfo->motorola_intel, value_ptr);
3351
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE,
3352
    "Process tag(x%04X=%s,@0x%04X + x%04X(=%d)): %s%s %s",
3353
    tag, exif_get_tagname_debug(tag, tag_table), offset_val+displacement, byte_count, byte_count, (components>1)&&format!=TAG_FMT_UNDEFINED&&format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(format), dump_data);
3354
  if (dump_free) {
3355
    efree(dump_data);
3356
  }
3357
#endif
3358
3359
  /* NB: The following code may not assume that there is at least one component!
3360
   * byte_count may be zero! */
3361
3362
85.7k
  if (section_index==SECTION_THUMBNAIL) {
3363
21.3k
    if (!ImageInfo->Thumbnail.data) {
3364
21.3k
      REQUIRE_NON_EMPTY();
3365
20.2k
      switch(tag) {
3366
1.75k
        case TAG_IMAGEWIDTH:
3367
1.83k
        case TAG_COMP_IMAGE_WIDTH:
3368
1.83k
          ImageInfo->Thumbnail.width = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3369
1.83k
          break;
3370
3371
465
        case TAG_IMAGEHEIGHT:
3372
471
        case TAG_COMP_IMAGE_HEIGHT:
3373
471
          ImageInfo->Thumbnail.height = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3374
471
          break;
3375
3376
356
        case TAG_STRIP_OFFSETS:
3377
683
        case TAG_JPEG_INTERCHANGE_FORMAT:
3378
          /* accept both formats */
3379
683
          ImageInfo->Thumbnail.offset = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3380
683
          break;
3381
3382
658
        case TAG_STRIP_BYTE_COUNTS:
3383
658
          if (ImageInfo->FileType == IMAGE_FILETYPE_TIFF_II || ImageInfo->FileType == IMAGE_FILETYPE_TIFF_MM) {
3384
467
            ImageInfo->Thumbnail.filetype = ImageInfo->FileType;
3385
467
          } else {
3386
            /* motorola is easier to read */
3387
191
            ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_TIFF_MM;
3388
191
          }
3389
658
          ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3390
658
          break;
3391
3392
567
        case TAG_JPEG_INTERCHANGE_FORMAT_LEN:
3393
567
          if (ImageInfo->Thumbnail.filetype == IMAGE_FILETYPE_UNKNOWN) {
3394
108
            ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_JPEG;
3395
108
            ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3396
108
          }
3397
567
          break;
3398
20.2k
      }
3399
20.2k
    }
3400
64.4k
  } else {
3401
64.4k
    if (section_index==SECTION_IFD0 || section_index==SECTION_EXIF)
3402
43.8k
    switch(tag) {
3403
1.49k
      case TAG_COPYRIGHT: {
3404
1.49k
        size_t length;
3405
        /* check for "<photographer> NUL <editor> NUL" */
3406
1.49k
        if (byte_count>1 && (length=zend_strnlen(value_ptr, byte_count)) > 0) {
3407
1.27k
          if (length<byte_count-1) {
3408
            /* When there are any characters after the first NUL */
3409
1.26k
            EFREE_IF(ImageInfo->CopyrightPhotographer);
3410
1.26k
            EFREE_IF(ImageInfo->CopyrightEditor);
3411
1.26k
            EFREE_IF(ImageInfo->Copyright);
3412
1.26k
            ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
3413
1.26k
            ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
3414
1.26k
            spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
3415
            /* format = TAG_FMT_UNDEFINED; this mustn't be ASCII         */
3416
            /* but we are not supposed to change this                   */
3417
            /* keep in mind that image_info does not store editor value */
3418
1.26k
          } else {
3419
18
            EFREE_IF(ImageInfo->Copyright);
3420
18
            ImageInfo->Copyright = estrndup(value_ptr, byte_count);
3421
18
          }
3422
1.27k
        }
3423
1.49k
        break;
3424
0
      }
3425
3426
1.03k
      case TAG_USERCOMMENT:
3427
1.03k
        EFREE_IF(ImageInfo->UserComment);
3428
1.03k
        ImageInfo->UserComment = NULL;
3429
1.03k
        EFREE_IF(ImageInfo->UserCommentEncoding);
3430
1.03k
        ImageInfo->UserCommentEncoding = NULL;
3431
1.03k
        ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
3432
1.03k
        break;
3433
3434
609
      case TAG_XP_TITLE:
3435
996
      case TAG_XP_COMMENTS:
3436
1.80k
      case TAG_XP_AUTHOR:
3437
2.32k
      case TAG_XP_KEYWORDS:
3438
2.32k
      case TAG_XP_SUBJECT: {
3439
2.32k
        xp_field_type *tmp_xp = (xp_field_type*)safe_erealloc(ImageInfo->xp_fields.list, (ImageInfo->xp_fields.count+1), sizeof(xp_field_type), 0);
3440
2.32k
        ImageInfo->sections_found |= FOUND_WINXP;
3441
2.32k
        ImageInfo->xp_fields.list = tmp_xp;
3442
2.32k
        ImageInfo->xp_fields.count++;
3443
2.32k
        exif_process_unicode(ImageInfo, &(ImageInfo->xp_fields.list[ImageInfo->xp_fields.count-1]), tag, value_ptr, byte_count);
3444
2.32k
        break;
3445
2.32k
      }
3446
3447
519
      case TAG_FNUMBER:
3448
        /* Simplest way of expressing aperture, so I trust it the most.
3449
           (overwrite previously computed value if there is one) */
3450
519
        REQUIRE_NON_EMPTY();
3451
519
        ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3452
519
        break;
3453
3454
701
      case TAG_APERTURE:
3455
901
      case TAG_MAX_APERTURE:
3456
        /* More relevant info always comes earlier, so only use this field if we don't
3457
           have appropriate aperture information yet. */
3458
901
        if (ImageInfo->ApertureFNumber == 0) {
3459
252
          REQUIRE_NON_EMPTY();
3460
252
          ImageInfo->ApertureFNumber
3461
252
            = expf(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*logf(2.0)*0.5);
3462
252
        }
3463
901
        break;
3464
3465
901
      case TAG_SHUTTERSPEED:
3466
        /* More complicated way of expressing exposure time, so only use
3467
           this value if we don't already have it from somewhere else.
3468
           SHUTTERSPEED comes after EXPOSURE TIME
3469
          */
3470
407
        if (ImageInfo->ExposureTime == 0) {
3471
293
          REQUIRE_NON_EMPTY();
3472
290
          ImageInfo->ExposureTime
3473
290
            = expf(-exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*logf(2.0));
3474
290
        }
3475
404
        break;
3476
404
      case TAG_EXPOSURETIME:
3477
49
        ImageInfo->ExposureTime = -1;
3478
49
        break;
3479
3480
449
      case TAG_COMP_IMAGE_WIDTH:
3481
449
        REQUIRE_NON_EMPTY();
3482
444
        ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
3483
444
        break;
3484
3485
68
      case TAG_FOCALPLANE_X_RES:
3486
68
        REQUIRE_NON_EMPTY();
3487
68
        ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3488
68
        break;
3489
3490
448
      case TAG_SUBJECT_DISTANCE:
3491
        /* Indicates the distance the autofocus camera is focused to.
3492
           Tends to be less accurate as distance increases. */
3493
448
        REQUIRE_NON_EMPTY();
3494
448
        ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3495
448
        break;
3496
3497
187
      case TAG_FOCALPLANE_RESOLUTION_UNIT:
3498
187
        REQUIRE_NON_EMPTY();
3499
187
        switch (exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel)) {
3500
28
          case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
3501
0
          case 2:
3502
            /* According to the information I was using, 2 means meters.
3503
               But looking at the Cannon powershot's files, inches is the only
3504
               sensible value. */
3505
0
            ImageInfo->FocalplaneUnits = 25.4;
3506
0
            break;
3507
3508
1
          case 3: ImageInfo->FocalplaneUnits = 10;   break;  /* centimeter */
3509
0
          case 4: ImageInfo->FocalplaneUnits = 1;    break;  /* millimeter */
3510
4
          case 5: ImageInfo->FocalplaneUnits = .001; break;  /* micrometer */
3511
187
        }
3512
187
        break;
3513
3514
187
      case TAG_SUB_IFD:
3515
126
        if (format==TAG_FMT_IFD) {
3516
          /* If this is called we are either in a TIFFs thumbnail or a JPEG where we cannot handle it */
3517
          /* TIFF thumbnail: our data structure cannot store a thumbnail of a thumbnail */
3518
          /* JPEG do we have the data area and what to do with it */
3519
64
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Skip SUB IFD");
3520
64
        }
3521
126
        break;
3522
3523
2.24k
      case TAG_MAKE:
3524
2.24k
        EFREE_IF(ImageInfo->make);
3525
2.24k
        ImageInfo->make = estrndup(value_ptr, byte_count);
3526
2.24k
        break;
3527
125
      case TAG_MODEL:
3528
125
        EFREE_IF(ImageInfo->model);
3529
125
        ImageInfo->model = estrndup(value_ptr, byte_count);
3530
125
        break;
3531
3532
3.30k
      case TAG_MAKER_NOTE:
3533
3.30k
        if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, info, displacement)) {
3534
1.30k
          EFREE_IF(outside);
3535
1.30k
          return false;
3536
1.30k
        }
3537
2.00k
        break;
3538
3539
2.00k
      case TAG_EXIF_IFD_POINTER:
3540
451
      case TAG_GPS_IFD_POINTER:
3541
764
      case TAG_INTEROP_IFD_POINTER:
3542
764
        if (ReadNextIFD) {
3543
764
          REQUIRE_NON_EMPTY();
3544
763
          char *Subdir_start;
3545
763
          int sub_section_index = 0;
3546
763
          switch(tag) {
3547
356
            case TAG_EXIF_IFD_POINTER:
3548
#ifdef EXIF_DEBUG
3549
              exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found EXIF");
3550
#endif
3551
356
              ImageInfo->sections_found |= FOUND_EXIF;
3552
356
              sub_section_index = SECTION_EXIF;
3553
356
              break;
3554
94
            case TAG_GPS_IFD_POINTER:
3555
#ifdef EXIF_DEBUG
3556
              exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found GPS");
3557
#endif
3558
94
              ImageInfo->sections_found |= FOUND_GPS;
3559
94
              sub_section_index = SECTION_GPS;
3560
94
              break;
3561
313
            case TAG_INTEROP_IFD_POINTER:
3562
#ifdef EXIF_DEBUG
3563
              exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found INTEROPERABILITY");
3564
#endif
3565
313
              ImageInfo->sections_found |= FOUND_INTEROP;
3566
313
              sub_section_index = SECTION_INTEROP;
3567
313
              break;
3568
763
          }
3569
763
          offset_val = php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
3570
763
          Subdir_start = exif_offset_info_try_get(info, offset_val, 0);
3571
763
          if (!Subdir_start) {
3572
8
            exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
3573
8
            EFREE_IF(outside);
3574
8
            return false;
3575
8
          }
3576
755
          if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, info, displacement, sub_section_index, tag)) {
3577
298
            EFREE_IF(outside);
3578
298
            return false;
3579
298
          }
3580
#ifdef EXIF_DEBUG
3581
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(sub_section_index));
3582
#endif
3583
755
        }
3584
43.8k
    }
3585
64.4k
  }
3586
83.0k
  exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname_key(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr, byte_count);
3587
83.0k
  EFREE_IF(outside);
3588
83.0k
  return true;
3589
85.7k
}
3590
/* }}} */
3591
3592
static bool exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, const exif_offset_info *info, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
3593
108k
{
3594
108k
  bool result;
3595
  /* Protect against corrupt headers */
3596
108k
  if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
3597
840
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum IFD tag count reached");
3598
840
    return false;
3599
840
  }
3600
107k
  if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
3601
14.8k
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
3602
14.8k
    return false;
3603
14.8k
  }
3604
92.9k
  ImageInfo->ifd_nesting_level++;
3605
92.9k
  result = exif_process_IFD_TAG_impl(ImageInfo, dir_entry, info, displacement, section_index, ReadNextIFD, tag_table);
3606
92.9k
  ImageInfo->ifd_nesting_level--;
3607
92.9k
  return result;
3608
107k
}
3609
3610
/* {{{ exif_process_IFD_in_JPEG
3611
 * Process one of the nested IFDs directories. */
3612
static bool exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, const exif_offset_info *info, size_t displacement, int section_index, int tag)
3613
1.34k
{
3614
1.34k
  int de;
3615
1.34k
  int NumDirEntries;
3616
1.34k
  int NextDirOffset = 0;
3617
3618
#ifdef EXIF_DEBUG
3619
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s (x%04X(=%d))", exif_get_sectionname(section_index), exif_offset_info_length(info), exif_offset_info_length(info));
3620
#endif
3621
3622
1.34k
  ImageInfo->sections_found |= FOUND_IFD0;
3623
3624
1.34k
  if (!exif_offset_info_contains(info, dir_start, 2)) {
3625
2
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3626
2
    return false;
3627
2
  }
3628
3629
1.33k
  NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
3630
3631
1.33k
  if (!exif_offset_info_contains(info, dir_start+2, NumDirEntries*12)) {
3632
5
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: x%04X + 2 + x%04X*12 = x%04X > x%04X", (int)((size_t)dir_start+2-(size_t)info->valid_start), NumDirEntries, (int)((size_t)dir_start+2+NumDirEntries*12-(size_t)info->valid_start), info->valid_end - info->valid_start);
3633
5
    return false;
3634
5
  }
3635
3636
9.40k
  for (de=0;de<NumDirEntries;de++) {
3637
8.46k
    if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
3638
8.46k
                  info, displacement, section_index, 1, exif_get_tag_table(section_index))) {
3639
391
      return false;
3640
391
    }
3641
8.46k
  }
3642
  /*
3643
   * Ignore IFD2 if it purportedly exists
3644
   */
3645
943
  if (section_index == SECTION_THUMBNAIL) {
3646
362
    return true;
3647
362
  }
3648
  /*
3649
   * Hack to make it process IDF1 I hope
3650
   * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
3651
   */
3652
581
  if (!exif_offset_info_contains(info, dir_start+2+NumDirEntries*12, 4)) {
3653
10
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3654
10
    return false;
3655
10
  }
3656
3657
571
  if (tag != TAG_EXIF_IFD_POINTER && tag != TAG_GPS_IFD_POINTER) {
3658
405
    NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
3659
405
  }
3660
3661
571
  if (NextDirOffset) {
3662
395
    char *next_dir_start = exif_offset_info_try_get(info, NextDirOffset, 0);
3663
395
    if (!next_dir_start) {
3664
19
      exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD offset");
3665
19
      return false;
3666
19
    }
3667
    /* That is the IFD for the first thumbnail */
3668
#ifdef EXIF_DEBUG
3669
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Expect next IFD to be thumbnail");
3670
#endif
3671
376
    if (exif_process_IFD_in_JPEG(ImageInfo, next_dir_start, info, displacement, SECTION_THUMBNAIL, 0)) {
3672
#ifdef EXIF_DEBUG
3673
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail size: 0x%04X", ImageInfo->Thumbnail.size);
3674
#endif
3675
362
      if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
3676
264
      &&  ImageInfo->Thumbnail.size
3677
185
      &&  ImageInfo->Thumbnail.offset
3678
102
      &&  ImageInfo->read_thumbnail
3679
362
      ) {
3680
0
        exif_thumbnail_extract(ImageInfo, info);
3681
0
      }
3682
362
      return true;
3683
362
    } else {
3684
14
      return false;
3685
14
    }
3686
376
  }
3687
176
  return true;
3688
571
}
3689
/* }}} */
3690
3691
/* {{{ exif_process_TIFF_in_JPEG
3692
   Process a TIFF header in a JPEG file
3693
*/
3694
static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement)
3695
1.72k
{
3696
1.72k
  unsigned exif_value_2a, offset_of_ifd;
3697
1.72k
  exif_offset_info info;
3698
3699
1.72k
  if (length < 2) {
3700
57
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
3701
57
    return;
3702
57
  }
3703
3704
  /* set the thumbnail stuff to nothing so we can test to see if they get set up */
3705
1.67k
  if (memcmp(CharBuf, "II", 2) == 0) {
3706
947
    ImageInfo->motorola_intel = 0;
3707
947
  } else if (memcmp(CharBuf, "MM", 2) == 0) {
3708
451
    ImageInfo->motorola_intel = 1;
3709
451
  } else {
3710
272
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF alignment marker");
3711
272
    return;
3712
272
  }
3713
3714
  /* Check the next two values for correctness. */
3715
1.39k
  if (length < 8) {
3716
394
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3717
394
    return;
3718
394
  }
3719
1.00k
  exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
3720
1.00k
  offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
3721
1.00k
  if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
3722
484
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3723
484
    return;
3724
484
  }
3725
520
  if (offset_of_ifd > length) {
3726
310
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start");
3727
310
    return;
3728
310
  }
3729
3730
210
  ImageInfo->sections_found |= FOUND_IFD0;
3731
  /* First directory starts at offset 8. Offsets starts at 0. */
3732
210
  exif_offset_info_init(&info, CharBuf, CharBuf, length/*-14*/);
3733
210
  exif_process_IFD_in_JPEG(ImageInfo, CharBuf+offset_of_ifd, &info, displacement, SECTION_IFD0, 0);
3734
3735
#ifdef EXIF_DEBUG
3736
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process TIFF in JPEG done");
3737
#endif
3738
3739
  /* Compute the CCD width, in millimeters. */
3740
210
  if (ImageInfo->FocalplaneXRes != 0) {
3741
0
    ImageInfo->CCDWidth = (float)(ImageInfo->ExifImageWidth * ImageInfo->FocalplaneUnits / ImageInfo->FocalplaneXRes);
3742
0
  }
3743
210
}
3744
/* }}} */
3745
3746
/* {{{ exif_process_APP1
3747
   Process an JPEG APP1 block marker
3748
   Describes all the drivel that most digital cameras include...
3749
*/
3750
static void exif_process_APP1(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement)
3751
2.98k
{
3752
  /* Check the APP1 for Exif Identifier Code */
3753
2.98k
  static const uchar ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
3754
2.98k
  if (length <= 8 || memcmp(CharBuf+2, ExifHeader, 6)) {
3755
1.26k
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Incorrect APP1 Exif Identifier Code");
3756
1.26k
    return;
3757
1.26k
  }
3758
1.72k
  exif_process_TIFF_in_JPEG(ImageInfo, CharBuf + 8, length - 8, displacement+8);
3759
#ifdef EXIF_DEBUG
3760
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process APP1/EXIF done");
3761
#endif
3762
1.72k
}
3763
/* }}} */
3764
3765
/* {{{ exif_process_APP12
3766
   Process an JPEG APP12 block marker used by OLYMPUS
3767
*/
3768
static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t length)
3769
731
{
3770
731
  size_t l1, l2=0;
3771
3772
731
  if ((l1 = zend_strnlen(buffer+2, length-2)) > 0) {
3773
549
    exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2, l1);
3774
549
    if (length > 2+l1+1) {
3775
251
      l2 = zend_strnlen(buffer+2+l1+1, length-2-l1-1);
3776
251
      exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1, l2);
3777
251
    }
3778
549
  }
3779
#ifdef EXIF_DEBUG
3780
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section APP12 with l1=%d, l2=%d done", l1, l2);
3781
#endif
3782
731
}
3783
/* }}} */
3784
3785
/* {{{ exif_scan_JPEG_header
3786
 * Parse the marker stream until SOS or EOI is seen; */
3787
static bool exif_scan_JPEG_header(image_info_type *ImageInfo)
3788
449
{
3789
449
  int sn;
3790
449
  int marker = 0, last_marker = M_PSEUDO, comment_correction=1;
3791
449
  unsigned int ll, lh;
3792
449
  uchar *Data;
3793
449
  size_t fpos, size, got, itemlen;
3794
449
  jpeg_sof_info sof_info;
3795
3796
443k
  while (true) {
3797
#ifdef EXIF_DEBUG
3798
    fpos = php_stream_tell(ImageInfo->infile);
3799
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Needing section %d @ 0x%08X", ImageInfo->file.count, fpos);
3800
#endif
3801
3802
    /* get marker byte, swallowing possible padding                           */
3803
    /* some software does not count the length bytes of COM section           */
3804
    /* one company doing so is very much involved in JPEG... so we accept too */
3805
443k
    if (last_marker==M_COM && comment_correction) {
3806
644
      comment_correction = 2;
3807
644
    }
3808
461k
    do {
3809
461k
      if ((marker = php_stream_getc(ImageInfo->infile)) == EOF) {
3810
116
        EXIF_ERRLOG_CORRUPT(ImageInfo)
3811
116
        return false;
3812
116
      }
3813
461k
      if (last_marker==M_COM && comment_correction>0) {
3814
795
        if (marker!=0xFF) {
3815
250
          marker = 0xff;
3816
250
          comment_correction--;
3817
545
        } else  {
3818
545
          last_marker = M_PSEUDO; /* stop skipping 0 for M_COM */
3819
545
        }
3820
795
      }
3821
461k
    } while (marker == 0xff);
3822
443k
    if (last_marker==M_COM && !comment_correction) {
3823
433k
      exif_error_docref("exif_read_data#error_mcom" EXIFERR_CC, ImageInfo, E_NOTICE, "Image has corrupt COM section: some software set wrong length information");
3824
433k
    }
3825
443k
    if (last_marker==M_COM && comment_correction)
3826
0
      return M_EOI; /* ah illegal: char after COM section not 0xFF */
3827
3828
443k
    fpos = php_stream_tell(ImageInfo->infile);
3829
3830
    /* safety net in case the above algorithm change dramatically, should not trigger */
3831
443k
    ZEND_ASSERT(marker != 0xff);
3832
3833
    /* Read the length of the section. */
3834
443k
    if ((lh = php_stream_getc(ImageInfo->infile)) == (unsigned int)EOF) {
3835
23
      EXIF_ERRLOG_CORRUPT(ImageInfo)
3836
23
      return false;
3837
23
    }
3838
443k
    if ((ll = php_stream_getc(ImageInfo->infile)) == (unsigned int)EOF) {
3839
58
      EXIF_ERRLOG_CORRUPT(ImageInfo)
3840
58
      return false;
3841
58
    }
3842
3843
443k
    itemlen = (lh << 8) | ll;
3844
3845
443k
    if (itemlen < 2) {
3846
#ifdef EXIF_DEBUG
3847
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s, Section length: 0x%02X%02X", EXIF_ERROR_CORRUPT, lh, ll);
3848
#else
3849
28
      EXIF_ERRLOG_CORRUPT(ImageInfo)
3850
28
#endif
3851
28
      return false;
3852
28
    }
3853
3854
443k
    sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
3855
443k
    Data = ImageInfo->file.list[sn].data;
3856
3857
    /* Store first two pre-read bytes. */
3858
443k
    Data[0] = (uchar)lh;
3859
443k
    Data[1] = (uchar)ll;
3860
3861
443k
    got = exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(Data+2), itemlen-2); /* Read the whole section. */
3862
443k
    if (got != itemlen-2) {
3863
153
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error reading from file: got=x%04X(=%d) != itemlen-2=x%04X(=%d)", got, got, itemlen-2, itemlen-2);
3864
153
      return false;
3865
153
    }
3866
3867
#ifdef EXIF_DEBUG
3868
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section(x%02X=%s) @ x%04X + x%04X(=%d)", marker, exif_get_markername(marker), fpos, itemlen, itemlen);
3869
#endif
3870
442k
    switch(marker) {
3871
4
      case M_SOS:   /* stop before hitting compressed data  */
3872
        /* If reading entire image is requested, read the rest of the data. */
3873
4
        if (ImageInfo->read_all) {
3874
          /* Determine how much file is left. */
3875
0
          fpos = php_stream_tell(ImageInfo->infile);
3876
0
          size = ImageInfo->FileSize - fpos;
3877
0
          sn = exif_file_sections_add(ImageInfo, M_PSEUDO, size, NULL);
3878
0
          Data = ImageInfo->file.list[sn].data;
3879
0
          got = exif_read_from_stream_file_looped(ImageInfo->infile, (char*)Data, size);
3880
0
          if (got != size) {
3881
0
            EXIF_ERRLOG_FILEEOF(ImageInfo)
3882
0
            return false;
3883
0
          }
3884
0
        }
3885
4
        return true;
3886
3887
59
      case M_EOI:   /* in case it's a tables-only JPEG stream */
3888
59
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "No image in jpeg!");
3889
59
        return (ImageInfo->sections_found&(~FOUND_COMPUTED)) ? true : false;
3890
3891
434k
      case M_COM: /* Comment section */
3892
434k
        exif_process_COM(ImageInfo, (char *)Data, itemlen);
3893
434k
        break;
3894
3895
3.15k
      case M_EXIF:
3896
3.15k
        if (!(ImageInfo->sections_found&FOUND_IFD0)) {
3897
          /*ImageInfo->sections_found |= FOUND_EXIF;*/
3898
          /* Seen files from some 'U-lead' software with Vivitar scanner
3899
             that uses marker 31 later in the file (no clue what for!) */
3900
2.96k
          exif_process_APP1(ImageInfo, (char *)Data, itemlen, fpos);
3901
2.96k
        }
3902
3.15k
        break;
3903
3904
731
      case M_APP12:
3905
731
        exif_process_APP12(ImageInfo, (char *)Data, itemlen);
3906
731
        break;
3907
3908
3909
260
      case M_SOF0:
3910
550
      case M_SOF1:
3911
747
      case M_SOF2:
3912
933
      case M_SOF3:
3913
1.08k
      case M_SOF5:
3914
1.76k
      case M_SOF6:
3915
1.96k
      case M_SOF7:
3916
2.32k
      case M_SOF9:
3917
2.58k
      case M_SOF10:
3918
2.77k
      case M_SOF11:
3919
2.96k
      case M_SOF13:
3920
3.20k
      case M_SOF14:
3921
3.39k
      case M_SOF15:
3922
3.39k
        if ((itemlen - 2) < 6) {
3923
8
          return false;
3924
8
        }
3925
3926
3.38k
        exif_process_SOFn(Data, marker, &sof_info);
3927
3.38k
        ImageInfo->Width  = sof_info.width;
3928
3.38k
        ImageInfo->Height = sof_info.height;
3929
3.38k
        if (sof_info.num_components == 3) {
3930
506
          ImageInfo->IsColor = 1;
3931
2.87k
        } else {
3932
2.87k
          ImageInfo->IsColor = 0;
3933
2.87k
        }
3934
3.38k
        break;
3935
1.16k
      default:
3936
        /* skip any other marker silently. */
3937
1.16k
        break;
3938
442k
    }
3939
3940
    /* keep track of last marker */
3941
442k
    last_marker = marker;
3942
442k
  }
3943
#ifdef EXIF_DEBUG
3944
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Done");
3945
#endif
3946
0
  return true;
3947
449
}
3948
/* }}} */
3949
3950
/* {{{ exif_scan_thumbnail
3951
 * scan JPEG in thumbnail (memory) */
3952
static bool exif_scan_thumbnail(image_info_type *ImageInfo)
3953
24
{
3954
24
  uchar           c, *data = (uchar*)ImageInfo->Thumbnail.data;
3955
24
  int             n, marker;
3956
24
  size_t          length=2, pos=0;
3957
24
  jpeg_sof_info   sof_info;
3958
3959
24
  if (!data || ImageInfo->Thumbnail.size < 4) {
3960
24
    return false; /* nothing to do here */
3961
24
  }
3962
0
  if (memcmp(data, "\xFF\xD8\xFF", 3)) {
3963
0
    if (!ImageInfo->Thumbnail.width && !ImageInfo->Thumbnail.height) {
3964
0
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Thumbnail is not a JPEG image");
3965
0
    }
3966
0
    return false;
3967
0
  }
3968
0
  for (;;) {
3969
0
    pos += length;
3970
0
    if (pos>=ImageInfo->Thumbnail.size)
3971
0
      return false;
3972
0
    c = data[pos++];
3973
0
    if (pos>=ImageInfo->Thumbnail.size)
3974
0
      return false;
3975
0
    if (c != 0xFF) {
3976
0
      return false;
3977
0
    }
3978
0
    n = 8;
3979
0
    while ((c = data[pos++]) == 0xFF && n--) {
3980
0
      if (pos+3>=ImageInfo->Thumbnail.size)
3981
0
        return false;
3982
      /* +3 = pos++ of next check when reaching marker + 2 bytes for length */
3983
0
    }
3984
0
    if (c == 0xFF)
3985
0
      return false;
3986
0
    marker = c;
3987
0
    if (pos>=ImageInfo->Thumbnail.size)
3988
0
      return false;
3989
0
    length = php_jpg_get16(data+pos);
3990
0
    if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
3991
0
      return false;
3992
0
    }
3993
#ifdef EXIF_DEBUG
3994
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process section(x%02X=%s) @ x%04X + x%04X", marker, exif_get_markername(marker), pos, length);
3995
#endif
3996
0
    switch (marker) {
3997
0
      case M_SOF0:
3998
0
      case M_SOF1:
3999
0
      case M_SOF2:
4000
0
      case M_SOF3:
4001
0
      case M_SOF5:
4002
0
      case M_SOF6:
4003
0
      case M_SOF7:
4004
0
      case M_SOF9:
4005
0
      case M_SOF10:
4006
0
      case M_SOF11:
4007
0
      case M_SOF13:
4008
0
      case M_SOF14:
4009
0
      case M_SOF15:
4010
        /* handle SOFn block */
4011
0
        if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
4012
          /* exif_process_SOFn needs 8 bytes */
4013
0
          return false;
4014
0
        }
4015
0
        exif_process_SOFn(data+pos, marker, &sof_info);
4016
0
        ImageInfo->Thumbnail.height   = sof_info.height;
4017
0
        ImageInfo->Thumbnail.width    = sof_info.width;
4018
#ifdef EXIF_DEBUG
4019
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size: %d * %d", sof_info.width, sof_info.height);
4020
#endif
4021
0
        return true;
4022
4023
0
      case M_SOS:
4024
0
      case M_EOI:
4025
0
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
4026
0
        return false;
4027
4028
0
      default:
4029
        /* just skip */
4030
0
        break;
4031
0
    }
4032
0
  }
4033
4034
0
  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
4035
0
  return false;
4036
0
}
4037
/* }}} */
4038
4039
/* {{{ exif_process_IFD_in_TIFF
4040
 * Parse the TIFF header; */
4041
static bool exif_process_IFD_in_TIFF_impl(image_info_type *ImageInfo, size_t dir_offset, int section_index)
4042
51.0k
{
4043
51.0k
  int i, sn, num_entries, sub_section_index = 0;
4044
51.0k
  unsigned char *dir_entry;
4045
51.0k
  size_t ifd_size, dir_size, next_offset, entry_length, entry_value=0;
4046
51.0k
  int entry_tag , entry_type;
4047
51.0k
  tag_table_type tag_table = exif_get_tag_table(section_index);
4048
4049
51.0k
  if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
4050
44.5k
    sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
4051
#ifdef EXIF_DEBUG
4052
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
4053
#endif
4054
44.5k
    php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
4055
44.5k
    if (UNEXPECTED(exif_read_from_stream_file_looped(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2) != 2)) {
4056
0
      return false;
4057
0
    }
4058
44.5k
    num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
4059
44.5k
    dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
4060
44.5k
    if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
4061
#ifdef EXIF_DEBUG
4062
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
4063
#endif
4064
42.3k
      if (exif_file_sections_realloc(ImageInfo, sn, dir_size)) {
4065
0
        return false;
4066
0
      }
4067
42.3k
      if (UNEXPECTED(exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+2), dir_size-2) != dir_size - 2)) {
4068
0
        return false;
4069
0
      }
4070
42.3k
      next_offset = php_ifd_get32u(ImageInfo->file.list[sn].data + dir_size - 4, ImageInfo->motorola_intel);
4071
#ifdef EXIF_DEBUG
4072
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF done, next offset x%04X", next_offset);
4073
#endif
4074
      /* now we have the directory we can look how long it should be */
4075
42.3k
      ifd_size = dir_size;
4076
18.5M
      for(i=0;i<num_entries;i++) {
4077
18.4M
        dir_entry    = ImageInfo->file.list[sn].data+2+i*12;
4078
18.4M
        entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
4079
18.4M
        entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
4080
18.4M
        if (entry_type > NUM_FORMATS) {
4081
14.7M
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: tag(0x%04X,%12s): Illegal format code 0x%04X, switching to BYTE", entry_tag, exif_get_tagname_debug(entry_tag, tag_table), entry_type);
4082
          /* Since this is repeated in exif_process_IFD_TAG make it a notice here */
4083
          /* and make it a warning in the exif_process_IFD_TAG which is called    */
4084
          /* elsewhere. */
4085
14.7M
          entry_type = TAG_FMT_BYTE;
4086
          /*The next line would break the image on writeback: */
4087
          /* php_ifd_set16u(dir_entry+2, entry_type, ImageInfo->motorola_intel);*/
4088
14.7M
        }
4089
18.4M
        entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel) * php_tiff_bytes_per_format[entry_type];
4090
18.4M
        if (entry_length <= 4) {
4091
3.67M
          switch(entry_type) {
4092
16.5k
            case TAG_FMT_USHORT:
4093
16.5k
              entry_value  = php_ifd_get16u(dir_entry+8, ImageInfo->motorola_intel);
4094
16.5k
              break;
4095
11.3k
            case TAG_FMT_SSHORT:
4096
11.3k
              entry_value  = php_ifd_get16s(dir_entry+8, ImageInfo->motorola_intel);
4097
11.3k
              break;
4098
7.80k
            case TAG_FMT_ULONG:
4099
7.80k
              entry_value  = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
4100
7.80k
              break;
4101
3.92k
            case TAG_FMT_SLONG:
4102
3.92k
              entry_value  = php_ifd_get32s(dir_entry+8, ImageInfo->motorola_intel);
4103
3.92k
              break;
4104
3.67M
          }
4105
3.67M
          switch(entry_tag) {
4106
60.1k
            case TAG_IMAGEWIDTH:
4107
60.6k
            case TAG_COMP_IMAGE_WIDTH:
4108
60.6k
              ImageInfo->Width  = entry_value;
4109
60.6k
              break;
4110
4.99k
            case TAG_IMAGEHEIGHT:
4111
5.47k
            case TAG_COMP_IMAGE_HEIGHT:
4112
5.47k
              ImageInfo->Height = entry_value;
4113
5.47k
              break;
4114
1.14k
            case TAG_PHOTOMETRIC_INTERPRETATION:
4115
1.14k
              switch (entry_value) {
4116
512
                case PMI_BLACK_IS_ZERO:
4117
512
                case PMI_WHITE_IS_ZERO:
4118
512
                case PMI_TRANSPARENCY_MASK:
4119
512
                  ImageInfo->IsColor = 0;
4120
512
                  break;
4121
1
                case PMI_RGB:
4122
307
                case PMI_PALETTE_COLOR:
4123
307
                case PMI_SEPARATED:
4124
307
                case PMI_YCBCR:
4125
351
                case PMI_CIELAB:
4126
351
                  ImageInfo->IsColor = 1;
4127
351
                  break;
4128
1.14k
              }
4129
1.14k
              break;
4130
3.67M
          }
4131
14.7M
        } else {
4132
14.7M
          size_t entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
4133
          /* if entry needs expanding ifd cache and entry is at end of current ifd cache. */
4134
          /* otherwise there may be huge holes between two entries */
4135
14.7M
          if (entry_offset + entry_length > dir_offset + ifd_size
4136
14.5M
            && entry_offset == dir_offset + ifd_size) {
4137
2.27k
            ifd_size = entry_offset + entry_length - dir_offset;
4138
#ifdef EXIF_DEBUG
4139
            exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Resize struct: x%04X + x%04X - x%04X = x%04X", entry_offset, entry_length, dir_offset, ifd_size);
4140
#endif
4141
2.27k
          }
4142
14.7M
        }
4143
18.4M
      }
4144
42.3k
      if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
4145
42.3k
        if (ifd_size > dir_size) {
4146
2.27k
          if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
4147
557
            exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
4148
557
            return false;
4149
557
          }
4150
1.71k
          if (exif_file_sections_realloc(ImageInfo, sn, ifd_size)) {
4151
0
            return false;
4152
0
          }
4153
          /* read values not stored in directory itself */
4154
#ifdef EXIF_DEBUG
4155
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
4156
#endif
4157
1.71k
          exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+dir_size), ifd_size-dir_size);
4158
#ifdef EXIF_DEBUG
4159
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF, done");
4160
#endif
4161
1.71k
        }
4162
        /* now process the tags */
4163
167k
        for(i=0;i<num_entries;i++) {
4164
149k
          dir_entry    = ImageInfo->file.list[sn].data+2+i*12;
4165
149k
          entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
4166
149k
          entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
4167
          /*entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);*/
4168
149k
          if (entry_tag == TAG_EXIF_IFD_POINTER ||
4169
116k
            entry_tag == TAG_INTEROP_IFD_POINTER ||
4170
113k
            entry_tag == TAG_GPS_IFD_POINTER ||
4171
105k
            entry_tag == TAG_SUB_IFD
4172
149k
          ) {
4173
52.2k
            switch(entry_tag) {
4174
33.8k
              case TAG_EXIF_IFD_POINTER:
4175
33.8k
                ImageInfo->sections_found |= FOUND_EXIF;
4176
33.8k
                sub_section_index = SECTION_EXIF;
4177
33.8k
                break;
4178
7.79k
              case TAG_GPS_IFD_POINTER:
4179
7.79k
                ImageInfo->sections_found |= FOUND_GPS;
4180
7.79k
                sub_section_index = SECTION_GPS;
4181
7.79k
                break;
4182
2.73k
              case TAG_INTEROP_IFD_POINTER:
4183
2.73k
                ImageInfo->sections_found |= FOUND_INTEROP;
4184
2.73k
                sub_section_index = SECTION_INTEROP;
4185
2.73k
                break;
4186
7.93k
              case TAG_SUB_IFD:
4187
7.93k
                ImageInfo->sections_found |= FOUND_THUMBNAIL;
4188
7.93k
                sub_section_index = SECTION_THUMBNAIL;
4189
7.93k
                break;
4190
52.2k
            }
4191
52.2k
            size_t entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
4192
#ifdef EXIF_DEBUG
4193
            exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s @0x%04X", exif_get_sectionname(sub_section_index), entry_offset);
4194
#endif
4195
52.2k
            exif_process_IFD_in_TIFF(ImageInfo, entry_offset, sub_section_index);
4196
52.2k
            if (section_index!=SECTION_THUMBNAIL && entry_tag==TAG_SUB_IFD) {
4197
1.50k
              if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
4198
1.00k
              &&  ImageInfo->Thumbnail.size
4199
953
              &&  ImageInfo->Thumbnail.offset
4200
296
              &&  ImageInfo->read_thumbnail
4201
1.50k
              ) {
4202
#ifdef EXIF_DEBUG
4203
                exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
4204
#endif
4205
0
                if (!ImageInfo->Thumbnail.data) {
4206
0
                  ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
4207
0
                  php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
4208
0
                  size_t fgot = exif_read_from_stream_file_looped(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
4209
0
                  if (fgot != ImageInfo->Thumbnail.size) {
4210
0
                    EXIF_ERRLOG_THUMBEOF(ImageInfo)
4211
0
                    efree(ImageInfo->Thumbnail.data);
4212
4213
0
                    ImageInfo->Thumbnail.data = NULL;
4214
0
                  } else {
4215
0
                    exif_thumbnail_build(ImageInfo);
4216
0
                  }
4217
0
                }
4218
0
              }
4219
1.50k
            }
4220
#ifdef EXIF_DEBUG
4221
            exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s done", exif_get_sectionname(sub_section_index));
4222
#endif
4223
97.6k
          } else {
4224
97.6k
            exif_offset_info info;
4225
97.6k
            exif_offset_info_init(&info,
4226
97.6k
              (char *) (ImageInfo->file.list[sn].data - dir_offset),
4227
97.6k
              (char *) ImageInfo->file.list[sn].data, ifd_size);
4228
97.6k
            if (!exif_process_IFD_TAG(ImageInfo, (char*)dir_entry, &info,
4229
97.6k
                          0, section_index, 0, tag_table)) {
4230
24.3k
              return false;
4231
24.3k
            }
4232
97.6k
          }
4233
149k
        }
4234
        /* If we had a thumbnail in a SUB_IFD we have ANOTHER image in NEXT IFD */
4235
17.4k
        if (next_offset && section_index != SECTION_THUMBNAIL) {
4236
          /* this should be a thumbnail IFD */
4237
          /* the thumbnail itself is stored at Tag=StripOffsets */
4238
#ifdef EXIF_DEBUG
4239
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) at x%04X", next_offset);
4240
#endif
4241
11.5k
          exif_process_IFD_in_TIFF(ImageInfo, next_offset, SECTION_THUMBNAIL);
4242
#ifdef EXIF_DEBUG
4243
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
4244
#endif
4245
11.5k
          if (!ImageInfo->Thumbnail.data && ImageInfo->Thumbnail.offset && ImageInfo->Thumbnail.size && ImageInfo->read_thumbnail) {
4246
0
            ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
4247
0
            php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
4248
0
            size_t fgot = exif_read_from_stream_file_looped(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
4249
0
            if (fgot != ImageInfo->Thumbnail.size) {
4250
0
              EXIF_ERRLOG_THUMBEOF(ImageInfo)
4251
0
              efree(ImageInfo->Thumbnail.data);
4252
0
              ImageInfo->Thumbnail.data = NULL;
4253
0
            } else {
4254
0
              exif_thumbnail_build(ImageInfo);
4255
0
            }
4256
0
          }
4257
#ifdef EXIF_DEBUG
4258
          exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
4259
#endif
4260
11.5k
        }
4261
17.4k
        return true;
4262
41.7k
      } else {
4263
0
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X)", ImageInfo->FileSize, dir_offset+ImageInfo->file.list[sn].size);
4264
0
        return false;
4265
0
      }
4266
42.3k
    } else {
4267
2.23k
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+dir_size);
4268
2.23k
      return false;
4269
2.23k
    }
4270
44.5k
  } else {
4271
6.47k
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than start of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+2);
4272
6.47k
    return false;
4273
6.47k
  }
4274
51.0k
}
4275
/* }}} */
4276
4277
static bool exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
4278
64.8k
{
4279
64.8k
  bool result;
4280
64.8k
  if (ImageInfo->ifd_count++ > MAX_IFD_TAGS) {
4281
575
    return false;
4282
575
  }
4283
64.2k
  if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
4284
13.2k
    return false;
4285
13.2k
  }
4286
51.0k
  ImageInfo->ifd_nesting_level++;
4287
51.0k
  result = exif_process_IFD_in_TIFF_impl(ImageInfo, dir_offset, section_index);
4288
51.0k
  ImageInfo->ifd_nesting_level--;
4289
51.0k
  return result;
4290
64.2k
}
4291
4292
/* Returns the size of the header, which must be smaller than the size of the box. */
4293
static int exif_isobmff_parse_box(unsigned char *buf, isobmff_box_type *box)
4294
4.04k
{
4295
4.04k
  box->size = php_ifd_get32u(buf, 1);
4296
4.04k
  buf += 4;
4297
4.04k
  box->type = php_ifd_get32u(buf, 1);
4298
4.04k
  if (box->size != 1) {
4299
2.84k
    return 8;
4300
2.84k
  }
4301
1.19k
  buf += 4;
4302
1.19k
  box->size = php_ifd_get64u(buf, 1);
4303
1.19k
  return 16;
4304
4.04k
}
4305
4306
static void exif_isobmff_parse_meta(unsigned char *data, unsigned char *end, isobmff_item_pos_type *pos)
4307
521
{
4308
521
  isobmff_box_type box, item;
4309
521
  unsigned char *p;
4310
521
  int header_size, exif_id = -1, version, item_count, i;
4311
4312
521
  size_t remain;
4313
2.81k
#define CHECK(n) do { \
4314
2.81k
  if (remain < (n)) { \
4315
141
    return; \
4316
141
  } \
4317
2.81k
} while (0)
4318
1.83k
#define ADVANCE(n) do { \
4319
1.83k
  CHECK(n); \
4320
1.83k
  remain -= (n); \
4321
1.73k
  p += (n); \
4322
1.73k
} while (0)
4323
4324
521
  unsigned char *box_offset = data + 4;
4325
1.74k
  while (box_offset < end - 16) {
4326
1.74k
    header_size = exif_isobmff_parse_box(box_offset, &box);
4327
1.74k
    if (box.size < header_size) {
4328
7
      return;
4329
7
    }
4330
1.73k
    p = box_offset;
4331
1.73k
    remain = end - p;
4332
4333
1.73k
    if (box.type == FOURCC("iinf")) {
4334
411
      ADVANCE(header_size + 4);
4335
410
      version = p[-4];
4336
410
      if (version < 2) {
4337
299
        ADVANCE(2);
4338
297
        item_count = php_ifd_get16u(p - 2, 1);
4339
297
      } else {
4340
111
        ADVANCE(4);
4341
109
        item_count = php_ifd_get32u(p - 4, 1);
4342
109
      }
4343
1.08k
      for (i = 0; i < item_count && p < end - 20; i++) {
4344
985
        header_size = exif_isobmff_parse_box(p, &item);
4345
985
        if (item.size < header_size) {
4346
8
          return;
4347
8
        }
4348
977
        CHECK(header_size + 12);
4349
932
        if (!memcmp(p + header_size + 8, "Exif", 4)) {
4350
166
          exif_id = php_ifd_get16u(p + header_size + 4, 1);
4351
166
          break;
4352
166
        }
4353
766
        ADVANCE(item.size);
4354
766
      }
4355
266
      if (exif_id < 0) {
4356
21
        break;
4357
21
      }
4358
266
    }
4359
1.32k
    else if (box.type == FOURCC("iloc")) {
4360
124
      ADVANCE(header_size + 6);
4361
123
      version = p[-6];
4362
123
      if (version < 2) {
4363
45
        ADVANCE(2);
4364
44
        item_count = php_ifd_get16u(p - 2, 1);
4365
78
      } else {
4366
78
        ADVANCE(4);
4367
76
        item_count = php_ifd_get32u(p - 4, 1);
4368
76
      }
4369
4.63k
      for (i = 0; i < item_count && p < end - 16; i++, p += 16) {
4370
4.59k
        if (php_ifd_get16u(p, 1) == exif_id) {
4371
79
          pos->offset = php_ifd_get32u(p + 8, 1);
4372
79
          pos->size = php_ifd_get32u(p + 12, 1);
4373
79
          break;
4374
79
        }
4375
4.59k
      }
4376
120
      break;
4377
123
    }
4378
4379
1.44k
    if (end - 16 - box_offset <= box.size) {
4380
224
      break;
4381
224
    }
4382
1.21k
    box_offset += box.size;
4383
1.21k
  }
4384
4385
521
#undef ADVANCE
4386
521
#undef CHECK
4387
521
}
4388
4389
static bool exif_scan_HEIF_header(image_info_type *ImageInfo, unsigned char *buf)
4390
585
{
4391
585
  isobmff_box_type box;
4392
585
  isobmff_item_pos_type pos;
4393
585
  unsigned char *data;
4394
585
  uint64_t limit;
4395
585
  int box_header_size, remain;
4396
585
  bool ret = false;
4397
4398
1.34k
  for (size_t offset = php_ifd_get32u(buf, 1); ImageInfo->FileSize - 16 > offset; offset += box.size) {
4399
1.31k
    if ((php_stream_seek(ImageInfo->infile, offset, SEEK_SET) < 0) ||
4400
1.31k
      (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)buf, 16) != 16)) {
4401
0
      break;
4402
0
    }
4403
1.31k
    box_header_size = exif_isobmff_parse_box(buf, &box);
4404
1.31k
    if (box.size < box_header_size) {
4405
3
      break;
4406
3
    }
4407
1.31k
    if (box.type == FOURCC("meta")) {
4408
549
      limit = box.size - box_header_size;
4409
549
      if (limit < 36) {
4410
0
        break;
4411
0
      }
4412
549
      data = (unsigned char *)emalloc(limit);
4413
549
      remain = 16 - box_header_size;
4414
549
      if (remain) {
4415
549
        memcpy(data, buf + box_header_size, remain);
4416
549
      }
4417
549
      memset(&pos, 0, sizeof(pos));
4418
549
      if (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(data + remain), limit - remain) == limit - remain) {
4419
521
        exif_isobmff_parse_meta(data, data + limit, &pos);
4420
521
      }
4421
549
      if ((pos.size >= 2) &&
4422
79
        (pos.size < ImageInfo->FileSize) &&
4423
43
        (ImageInfo->FileSize - pos.size >= pos.offset) &&
4424
21
        (php_stream_seek(ImageInfo->infile, pos.offset + 2, SEEK_SET) >= 0)) {
4425
21
        if (limit >= pos.size - 2) {
4426
15
          limit = pos.size - 2;
4427
15
        } else {
4428
6
          limit = pos.size - 2;
4429
6
          efree(data);
4430
6
          data = (unsigned char *)emalloc(limit);
4431
6
        }
4432
21
        if (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)data, limit) == limit) {
4433
21
          exif_process_APP1(ImageInfo, (char*)data, limit, pos.offset + 2);
4434
21
          ret = true;
4435
21
        }
4436
21
      }
4437
549
      efree(data);
4438
549
      break;
4439
549
    }
4440
764
    if (offset + box.size < offset) {
4441
1
      break;
4442
1
    }
4443
764
  }
4444
4445
585
  return ret;
4446
585
}
4447
4448
/* {{{ exif_scan_FILE_header
4449
 * Parse the marker stream until SOS or EOI is seen; */
4450
static bool exif_scan_FILE_header(image_info_type *ImageInfo)
4451
1.99k
{
4452
1.99k
  unsigned char file_header[16];
4453
4454
1.99k
  ImageInfo->FileType = IMAGE_FILETYPE_UNKNOWN;
4455
4456
1.99k
  if (UNEXPECTED(ImageInfo->FileSize < 2)) {
4457
0
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File too small (%d)", ImageInfo->FileSize);
4458
0
    return false;
4459
0
  }
4460
4461
1.99k
  php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
4462
1.99k
  if (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)file_header, 2) != 2) {
4463
0
    return false;
4464
0
  }
4465
4466
1.99k
  if ((file_header[0]==0xff) && (file_header[1]==M_SOI)) {
4467
449
    ImageInfo->FileType = IMAGE_FILETYPE_JPEG;
4468
449
    if (exif_scan_JPEG_header(ImageInfo)) {
4469
62
      return true;
4470
387
    } else {
4471
387
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid JPEG file");
4472
387
      return false;
4473
387
    }
4474
1.54k
  } else if (ImageInfo->FileSize >= 8) {
4475
1.54k
    if (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header+2), 6) != 6) {
4476
0
      return false;
4477
0
    }
4478
4479
1.54k
    if (!memcmp(file_header, "II\x2A\x00", 4)) {
4480
503
      ImageInfo->FileType = IMAGE_FILETYPE_TIFF_II;
4481
503
      ImageInfo->motorola_intel = 0;
4482
#ifdef EXIF_DEBUG
4483
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/II format");
4484
#endif
4485
503
      ImageInfo->sections_found |= FOUND_IFD0;
4486
503
      if (exif_process_IFD_in_TIFF(
4487
503
        ImageInfo,
4488
503
        php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
4489
503
        SECTION_IFD0
4490
503
      )) {
4491
423
        return true;
4492
423
      } else {
4493
80
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
4494
80
        return false;
4495
80
      }
4496
1.03k
    } else if (!memcmp(file_header, "MM\x00\x2a", 4)) {
4497
448
      ImageInfo->FileType = IMAGE_FILETYPE_TIFF_MM;
4498
448
      ImageInfo->motorola_intel = 1;
4499
#ifdef EXIF_DEBUG
4500
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/MM format");
4501
#endif
4502
448
      ImageInfo->sections_found |= FOUND_IFD0;
4503
448
      if (exif_process_IFD_in_TIFF(
4504
448
        ImageInfo,
4505
448
        php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
4506
448
        SECTION_IFD0
4507
448
      )) {
4508
277
        return true;
4509
277
      } else {
4510
171
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
4511
171
        return false;
4512
171
      }
4513
590
    } else if ((ImageInfo->FileSize > 16) &&
4514
590
         (!memcmp(file_header + 4, "ftyp", 4)) &&
4515
585
         (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(file_header + 8), 4) == 4) &&
4516
585
         ((!memcmp(file_header + 8, "heic", 4)) || (!memcmp(file_header + 8, "heix", 4)) || (!memcmp(file_header + 8, "mif1", 4)))) {
4517
585
      if (exif_scan_HEIF_header(ImageInfo, file_header)) {
4518
21
        ImageInfo->FileType = IMAGE_FILETYPE_HEIF;
4519
21
        return true;
4520
564
      } else {
4521
564
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid HEIF file");
4522
564
        return false;
4523
564
      }
4524
585
    } else {
4525
5
      exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File not supported");
4526
5
      return false;
4527
5
    }
4528
1.54k
  }
4529
0
  return false;
4530
1.99k
}
4531
/* }}} */
4532
4533
/* {{{ exif_discard_imageinfo
4534
   Discard data scanned by exif_read_file.
4535
*/
4536
static void exif_discard_imageinfo(image_info_type *ImageInfo)
4537
1.99k
{
4538
1.99k
  int i;
4539
4540
1.99k
  EFREE_IF(ImageInfo->FileName);
4541
1.99k
  EFREE_IF(ImageInfo->UserComment);
4542
1.99k
  EFREE_IF(ImageInfo->UserCommentEncoding);
4543
1.99k
  EFREE_IF(ImageInfo->Copyright);
4544
1.99k
  EFREE_IF(ImageInfo->CopyrightPhotographer);
4545
1.99k
  EFREE_IF(ImageInfo->CopyrightEditor);
4546
1.99k
  EFREE_IF(ImageInfo->Thumbnail.data);
4547
1.99k
  EFREE_IF(ImageInfo->encode_unicode);
4548
1.99k
  EFREE_IF(ImageInfo->decode_unicode_be);
4549
1.99k
  EFREE_IF(ImageInfo->decode_unicode_le);
4550
1.99k
  EFREE_IF(ImageInfo->encode_jis);
4551
1.99k
  EFREE_IF(ImageInfo->decode_jis_be);
4552
1.99k
  EFREE_IF(ImageInfo->decode_jis_le);
4553
1.99k
  EFREE_IF(ImageInfo->make);
4554
1.99k
  EFREE_IF(ImageInfo->model);
4555
4.31k
  for (i=0; i<ImageInfo->xp_fields.count; i++) {
4556
2.32k
    EFREE_IF(ImageInfo->xp_fields.list[i].value);
4557
2.32k
  }
4558
1.99k
  EFREE_IF(ImageInfo->xp_fields.list);
4559
29.8k
  for (i=0; i<SECTION_COUNT; i++) {
4560
27.8k
    exif_iif_free(ImageInfo, i);
4561
27.8k
  }
4562
1.99k
  exif_file_sections_free(ImageInfo);
4563
1.99k
  memset(ImageInfo, 0, sizeof(*ImageInfo));
4564
1.99k
}
4565
/* }}} */
4566
4567
/* {{{ exif_read_from_impl */
4568
static bool exif_read_from_impl(image_info_type *ImageInfo, php_stream *stream, int read_thumbnail, int read_all)
4569
1.99k
{
4570
1.99k
  bool ret;
4571
1.99k
  zend_stat_t st = {0};
4572
4573
  /* Start with an empty image information structure. */
4574
1.99k
  memset(ImageInfo, 0, sizeof(*ImageInfo));
4575
4576
1.99k
  ImageInfo->motorola_intel = -1; /* flag as unknown */
4577
1.99k
  ImageInfo->infile     = stream;
4578
1.99k
  ImageInfo->FileName     = NULL;
4579
4580
1.99k
  if (php_stream_is(ImageInfo->infile, PHP_STREAM_IS_STDIO)) {
4581
0
    if (stream->orig_path && VCWD_STAT(stream->orig_path, &st) >= 0) {
4582
0
      zend_string *base;
4583
0
      if ((st.st_mode & S_IFMT) != S_IFREG) {
4584
0
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Not a file");
4585
0
        ImageInfo->infile = NULL;
4586
0
        return false;
4587
0
      }
4588
4589
      /* Store file name */
4590
0
      base = php_basename(stream->orig_path, strlen(stream->orig_path), NULL, 0);
4591
0
      ImageInfo->FileName = estrndup(ZSTR_VAL(base), ZSTR_LEN(base));
4592
4593
0
      zend_string_release_ex(base, 0);
4594
4595
      /* Store file date/time. */
4596
0
      ImageInfo->FileDateTime = st.st_mtime;
4597
0
      ImageInfo->FileSize = st.st_size;
4598
0
    }
4599
1.99k
  } else {
4600
1.99k
    if (!ImageInfo->FileSize) {
4601
1.99k
      php_stream_seek(ImageInfo->infile, 0, SEEK_END);
4602
1.99k
      ImageInfo->FileSize = php_stream_tell(ImageInfo->infile);
4603
1.99k
      php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
4604
1.99k
    }
4605
1.99k
  }
4606
4607
1.99k
  ImageInfo->read_thumbnail   = read_thumbnail;
4608
1.99k
  ImageInfo->read_all       = read_all;
4609
1.99k
  ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_UNKNOWN;
4610
4611
1.99k
  ImageInfo->encode_unicode   = estrdup(EXIF_G(encode_unicode));
4612
1.99k
  ImageInfo->decode_unicode_be  = estrdup(EXIF_G(decode_unicode_be));
4613
1.99k
  ImageInfo->decode_unicode_le  = estrdup(EXIF_G(decode_unicode_le));
4614
1.99k
  ImageInfo->encode_jis     = estrdup(EXIF_G(encode_jis));
4615
1.99k
  ImageInfo->decode_jis_be    = estrdup(EXIF_G(decode_jis_be));
4616
1.99k
  ImageInfo->decode_jis_le    = estrdup(EXIF_G(decode_jis_le));
4617
4618
4619
1.99k
  ImageInfo->ifd_nesting_level = 0;
4620
1.99k
  ImageInfo->ifd_count = 0;
4621
1.99k
  ImageInfo->num_errors = 0;
4622
4623
  /* Scan the headers */
4624
1.99k
  ret = exif_scan_FILE_header(ImageInfo);
4625
4626
1.99k
  return ret;
4627
1.99k
}
4628
/* }}} */
4629
4630
/* {{{ exif_read_from_stream */
4631
static bool exif_read_from_stream(image_info_type *ImageInfo, php_stream *stream, int read_thumbnail, int read_all)
4632
1.99k
{
4633
1.99k
  bool ret;
4634
1.99k
  off_t old_pos = php_stream_tell(stream);
4635
4636
1.99k
  if (old_pos) {
4637
1.99k
    php_stream_seek(stream, 0, SEEK_SET);
4638
1.99k
  }
4639
4640
1.99k
  ret = exif_read_from_impl(ImageInfo, stream, read_thumbnail, read_all);
4641
4642
1.99k
  if (old_pos) {
4643
1.99k
    php_stream_seek(stream, old_pos, SEEK_SET);
4644
1.99k
  }
4645
4646
1.99k
  return ret;
4647
1.99k
}
4648
/* }}} */
4649
4650
/* {{{ exif_read_from_file */
4651
static bool exif_read_from_file(image_info_type *ImageInfo, const char *FileName, int read_thumbnail, int read_all)
4652
0
{
4653
0
  bool ret;
4654
0
  php_stream *stream;
4655
4656
0
  stream = php_stream_open_wrapper(FileName, "rb", STREAM_MUST_SEEK | IGNORE_PATH, NULL);
4657
4658
0
  if (!stream) {
4659
0
    memset(&ImageInfo, 0, sizeof(ImageInfo));
4660
4661
0
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Unable to open file");
4662
4663
0
    return false;
4664
0
  }
4665
4666
0
  ret = exif_read_from_stream(ImageInfo, stream, read_thumbnail, read_all);
4667
4668
0
  php_stream_close(stream);
4669
4670
0
  return ret;
4671
0
}
4672
/* }}} */
4673
4674
/* {{{ Reads header data from an image and optionally reads the internal thumbnails */
4675
PHP_FUNCTION(exif_read_data)
4676
1.99k
{
4677
1.99k
  zend_string *z_sections_needed = NULL;
4678
1.99k
  bool sub_arrays = 0, read_thumbnail = 0, read_all = 0;
4679
1.99k
  zval *stream;
4680
1.99k
  bool ret;
4681
1.99k
  int i, sections_needed = 0;
4682
1.99k
  image_info_type ImageInfo;
4683
1.99k
  char *sections_str;
4684
4685
  /* Parse arguments */
4686
5.97k
  ZEND_PARSE_PARAMETERS_START(1, 4)
4687
7.96k
    Z_PARAM_ZVAL(stream)
4688
7.96k
    Z_PARAM_OPTIONAL
4689
7.96k
    Z_PARAM_STR_OR_NULL(z_sections_needed)
4690
0
    Z_PARAM_BOOL(sub_arrays)
4691
0
    Z_PARAM_BOOL(read_thumbnail)
4692
1.99k
  ZEND_PARSE_PARAMETERS_END();
4693
4694
1.99k
  memset(&ImageInfo, 0, sizeof(ImageInfo));
4695
4696
1.99k
  if (z_sections_needed) {
4697
0
    spprintf(&sections_str, 0, ",%s,", ZSTR_VAL(z_sections_needed));
4698
    /* sections_str DOES start with , and SPACES are NOT allowed in names */
4699
0
    char *s = sections_str;
4700
0
    while (*++s) {
4701
0
      if (*s == ' ') {
4702
0
        *s = ',';
4703
0
      }
4704
0
    }
4705
4706
0
    for (i = 0; i < SECTION_COUNT; i++) {
4707
0
      char tmp[64];
4708
0
      snprintf(tmp, sizeof(tmp), ",%s,", exif_get_sectionname(i));
4709
0
      if (strstr(sections_str, tmp)) {
4710
0
        sections_needed |= 1<<i;
4711
0
      }
4712
0
    }
4713
0
    EFREE_IF(sections_str);
4714
    /* now see what we need */
4715
#ifdef EXIF_DEBUG
4716
    sections_str = exif_get_sectionlist(sections_needed);
4717
    if (!sections_str) {
4718
      RETURN_FALSE;
4719
    }
4720
    exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections needed: %s", sections_str[0] ? sections_str : "None");
4721
    EFREE_IF(sections_str);
4722
#endif
4723
0
  }
4724
4725
1.99k
  if (Z_TYPE_P(stream) == IS_RESOURCE) {
4726
1.99k
    php_stream *p_stream = NULL;
4727
4728
1.99k
    php_stream_from_res(p_stream, Z_RES_P(stream));
4729
4730
1.99k
    ret = exif_read_from_stream(&ImageInfo, p_stream, read_thumbnail, read_all);
4731
1.99k
  } else {
4732
0
    if (!try_convert_to_string(stream)) {
4733
0
      RETURN_THROWS();
4734
0
    }
4735
4736
0
    if (!Z_STRLEN_P(stream)) {
4737
0
      zend_argument_must_not_be_empty_error(1);
4738
0
      RETURN_THROWS();
4739
0
    }
4740
4741
0
    if (UNEXPECTED(zend_str_has_nul_byte(Z_STR_P(stream)))) {
4742
0
      zend_argument_value_error(1, "must not contain any null bytes");
4743
0
      RETURN_THROWS();
4744
0
    }
4745
4746
0
    ret = exif_read_from_file(&ImageInfo, Z_STRVAL_P(stream), read_thumbnail, read_all);
4747
0
  }
4748
4749
1.99k
  sections_str = exif_get_sectionlist(ImageInfo.sections_found);
4750
4751
#ifdef EXIF_DEBUG
4752
  if (sections_str) {
4753
    exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections found: %s", sections_str[0] ? sections_str : "None");
4754
  }
4755
#endif
4756
4757
1.99k
  ImageInfo.sections_found |= FOUND_COMPUTED|FOUND_FILE;/* do not inform about in debug*/
4758
4759
1.99k
  if (ret == false || (sections_needed && !(sections_needed&ImageInfo.sections_found))) {
4760
    /* array_init must be checked at last! otherwise the array must be freed if a later test fails. */
4761
1.20k
    exif_discard_imageinfo(&ImageInfo);
4762
1.20k
      EFREE_IF(sections_str);
4763
1.20k
    RETURN_FALSE;
4764
1.20k
  }
4765
4766
783
  array_init(return_value);
4767
4768
#ifdef EXIF_DEBUG
4769
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section FILE");
4770
#endif
4771
4772
  /* now we can add our information */
4773
783
  exif_iif_add_str(&ImageInfo, SECTION_FILE, "FileName",      ImageInfo.FileName);
4774
783
  exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileDateTime",  ImageInfo.FileDateTime);
4775
783
  exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileSize",      ImageInfo.FileSize);
4776
783
  exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileType",      ImageInfo.FileType);
4777
783
  exif_iif_add_str(&ImageInfo, SECTION_FILE, "MimeType",      php_image_type_to_mime_type(ImageInfo.FileType));
4778
783
  exif_iif_add_str(&ImageInfo, SECTION_FILE, "SectionsFound", sections_str ? sections_str : "NONE");
4779
4780
#ifdef EXIF_DEBUG
4781
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section COMPUTED");
4782
#endif
4783
4784
783
  if (ImageInfo.Width>0 &&  ImageInfo.Height>0) {
4785
40
    exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "html"   , "width=\"%d\" height=\"%d\"", ImageInfo.Width, ImageInfo.Height);
4786
40
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Height", ImageInfo.Height);
4787
40
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Width",  ImageInfo.Width);
4788
40
  }
4789
783
  exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "IsColor", ImageInfo.IsColor);
4790
783
  if (ImageInfo.motorola_intel != -1) {
4791
712
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "ByteOrderMotorola", ImageInfo.motorola_intel);
4792
712
  }
4793
783
  if (ImageInfo.FocalLength) {
4794
0
    exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocalLength", "%4.1Fmm", ImageInfo.FocalLength);
4795
0
    if(ImageInfo.CCDWidth) {
4796
0
      exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "35mmFocalLength", "%dmm", (int)(ImageInfo.FocalLength/ImageInfo.CCDWidth*35+0.5));
4797
0
    }
4798
0
  }
4799
783
  if(ImageInfo.CCDWidth) {
4800
0
    exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
4801
0
  }
4802
783
  if(ImageInfo.ExposureTime>0) {
4803
42
    float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
4804
42
    if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < (float)INT_MAX) {
4805
9
      exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
4806
33
    } else {
4807
33
      exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
4808
33
    }
4809
42
  }
4810
783
  if(ImageInfo.ApertureFNumber) {
4811
121
    exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ApertureFNumber", "f/%.1F", ImageInfo.ApertureFNumber);
4812
121
  }
4813
783
  if(ImageInfo.Distance) {
4814
44
    if(ImageInfo.Distance<0) {
4815
2
      exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "FocusDistance", "Infinite");
4816
42
    } else {
4817
42
      exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocusDistance", "%0.2Fm", ImageInfo.Distance);
4818
42
    }
4819
44
  }
4820
783
  if (ImageInfo.UserComment) {
4821
100
    exif_iif_add_buffer(&ImageInfo, SECTION_COMPUTED, "UserComment", ImageInfo.UserCommentLength, ImageInfo.UserComment);
4822
100
    if (ImageInfo.UserCommentEncoding && strlen(ImageInfo.UserCommentEncoding)) {
4823
14
      exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "UserCommentEncoding", ImageInfo.UserCommentEncoding);
4824
14
    }
4825
100
  }
4826
4827
783
  exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright",              ImageInfo.Copyright);
4828
783
  exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Photographer", ImageInfo.CopyrightPhotographer);
4829
783
  exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Editor",       ImageInfo.CopyrightEditor);
4830
4831
3.09k
  for (i=0; i<ImageInfo.xp_fields.count; i++) {
4832
2.30k
    exif_iif_add_str(&ImageInfo, SECTION_WINXP, exif_get_tagname_debug(ImageInfo.xp_fields.list[i].tag, exif_get_tag_table(SECTION_WINXP)), ImageInfo.xp_fields.list[i].value);
4833
2.30k
  }
4834
783
  if (ImageInfo.Thumbnail.size) {
4835
29
    if (read_thumbnail) {
4836
      /* not exif_iif_add_str : this is a buffer */
4837
0
      exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
4838
0
    }
4839
29
    if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
4840
      /* try to evaluate if thumbnail data is present */
4841
24
      exif_scan_thumbnail(&ImageInfo);
4842
24
    }
4843
29
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.FileType", ImageInfo.Thumbnail.filetype);
4844
29
    exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Thumbnail.MimeType", (char*)php_image_type_to_mime_type(ImageInfo.Thumbnail.filetype));
4845
29
  }
4846
783
  if (ImageInfo.Thumbnail.width && ImageInfo.Thumbnail.height) {
4847
15
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Height", ImageInfo.Thumbnail.height);
4848
15
    exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Width",  ImageInfo.Thumbnail.width);
4849
15
  }
4850
783
  EFREE_IF(sections_str);
4851
4852
#ifdef EXIF_DEBUG
4853
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Adding image infos");
4854
#endif
4855
4856
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FILE      );
4857
783
  add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMPUTED  );
4858
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_ANY_TAG   );
4859
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_IFD0      );
4860
783
  add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_THUMBNAIL );
4861
783
  add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMMENT   );
4862
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_EXIF      );
4863
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_GPS       );
4864
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_INTEROP   );
4865
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FPIX      );
4866
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_APP12     );
4867
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_WINXP     );
4868
783
  add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_MAKERNOTE );
4869
4870
#ifdef EXIF_DEBUG
4871
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4872
#endif
4873
4874
783
  exif_discard_imageinfo(&ImageInfo);
4875
4876
#ifdef EXIF_DEBUG
4877
  php_error_docref1(NULL, (Z_TYPE_P(stream) == IS_RESOURCE ? "<stream>" : Z_STRVAL_P(stream)), E_NOTICE, "Done");
4878
#endif
4879
783
}
4880
/* }}} */
4881
4882
/* {{{ Reads the embedded thumbnail */
4883
PHP_FUNCTION(exif_thumbnail)
4884
0
{
4885
0
  bool ret;
4886
0
  image_info_type ImageInfo;
4887
0
  zval *stream;
4888
0
  zval *z_width = NULL, *z_height = NULL, *z_imagetype = NULL;
4889
4890
  /* Parse arguments */
4891
0
  ZEND_PARSE_PARAMETERS_START(1, 4)
4892
0
    Z_PARAM_ZVAL(stream)
4893
0
    Z_PARAM_OPTIONAL
4894
0
    Z_PARAM_ZVAL(z_width)
4895
0
    Z_PARAM_ZVAL(z_height)
4896
0
    Z_PARAM_ZVAL(z_imagetype)
4897
0
  ZEND_PARSE_PARAMETERS_END();
4898
4899
0
  memset(&ImageInfo, 0, sizeof(ImageInfo));
4900
4901
0
  if (Z_TYPE_P(stream) == IS_RESOURCE) {
4902
0
    php_stream *p_stream = NULL;
4903
4904
0
    php_stream_from_res(p_stream, Z_RES_P(stream));
4905
4906
0
    ret = exif_read_from_stream(&ImageInfo, p_stream, 1, 0);
4907
0
  } else {
4908
0
    if (!try_convert_to_string(stream)) {
4909
0
      RETURN_THROWS();
4910
0
    }
4911
4912
0
    if (!Z_STRLEN_P(stream)) {
4913
0
      zend_argument_must_not_be_empty_error(1);
4914
0
      RETURN_THROWS();
4915
0
    }
4916
4917
0
    if (zend_str_has_nul_byte(Z_STR_P(stream))) {
4918
0
      zend_argument_value_error(1, "must not contain any null bytes");
4919
0
      RETURN_THROWS();
4920
0
    }
4921
4922
0
    ret = exif_read_from_file(&ImageInfo, Z_STRVAL_P(stream), 1, 0);
4923
0
  }
4924
4925
0
  if (ret == false) {
4926
0
    exif_discard_imageinfo(&ImageInfo);
4927
0
    RETURN_FALSE;
4928
0
  }
4929
4930
#ifdef EXIF_DEBUG
4931
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Thumbnail data %d %d %d, %d x %d", ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.filetype, ImageInfo.Thumbnail.width, ImageInfo.Thumbnail.height);
4932
#endif
4933
0
  if (!ImageInfo.Thumbnail.data || !ImageInfo.Thumbnail.size) {
4934
0
    exif_discard_imageinfo(&ImageInfo);
4935
0
    RETURN_FALSE;
4936
0
  }
4937
4938
#ifdef EXIF_DEBUG
4939
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Returning thumbnail(%d)", ImageInfo.Thumbnail.size);
4940
#endif
4941
4942
0
  RETVAL_STRINGL(ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
4943
0
  if ((z_width || z_height) && (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height)) {
4944
0
    if (!exif_scan_thumbnail(&ImageInfo)) {
4945
0
      ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
4946
0
    }
4947
0
  }
4948
0
  if (z_width) {
4949
0
    ZEND_TRY_ASSIGN_REF_LONG(z_width,  ImageInfo.Thumbnail.width);
4950
0
  }
4951
0
  if (z_height) {
4952
0
    ZEND_TRY_ASSIGN_REF_LONG(z_height, ImageInfo.Thumbnail.height);
4953
0
  }
4954
0
  if (z_imagetype) {
4955
0
    ZEND_TRY_ASSIGN_REF_LONG(z_imagetype, ImageInfo.Thumbnail.filetype);
4956
0
  }
4957
4958
#ifdef EXIF_DEBUG
4959
  exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4960
#endif
4961
4962
0
  exif_discard_imageinfo(&ImageInfo);
4963
4964
#ifdef EXIF_DEBUG
4965
  php_error_docref1(NULL, (Z_TYPE_P(stream) == IS_RESOURCE ? "<stream>" : Z_STRVAL_P(stream)), E_NOTICE, "Done");
4966
#endif
4967
0
}
4968
/* }}} */
4969
4970
/* {{{ Get the type of an image */
4971
PHP_FUNCTION(exif_imagetype)
4972
0
{
4973
0
  char *imagefile;
4974
0
  size_t imagefile_len;
4975
0
  php_stream * stream;
4976
0
  int itype = 0;
4977
4978
0
  if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &imagefile, &imagefile_len) == FAILURE) {
4979
0
    RETURN_THROWS();
4980
0
  }
4981
4982
0
  stream = php_stream_open_wrapper(imagefile, "rb", IGNORE_PATH|REPORT_ERRORS, NULL);
4983
4984
0
  if (stream == NULL) {
4985
0
    RETURN_FALSE;
4986
0
  }
4987
4988
0
  itype = php_getimagetype(stream, imagefile, NULL);
4989
4990
0
  php_stream_close(stream);
4991
4992
0
  if (itype == IMAGE_FILETYPE_UNKNOWN) {
4993
0
    RETURN_FALSE;
4994
0
  } else {
4995
0
    ZVAL_LONG(return_value, itype);
4996
0
  }
4997
0
}
4998
/* }}} */