adrian-enspired pushed a commit to adrian-enspired/php-src that referenced this pull request
exif_process_IFD_TAG() currently accepts a dir_entry, offset_base and IFDlength. However, it's very hard to follow how these values are related to each other and the addressable memory region. As we add additional bounds check, this gets further confused. One of the basic cases is where dir_entry is in [offset_base, offset_base+IFDlength), in which case the memory [dir_entry, offset_base+IFDlength) is valid, but the memory [offset_base, dir_entry) is not necessarily valid. I wasn't able to understand what exactly is valid if dir_entry is outside [offset_base, offset_base+IFDlength) This patch changes everything to use a struct that separately stores offset_base and the valid memory region and adds helpers to fetch offsets and check that pointers are in-bounds. Closes phpGH-5068.