A segment which consists only of the marker and length value
(equal to 2, the length of the value itself) appears to be
perfectly valid, and is ignored by every image viewer I tested.
Bug: T147015
Change-Id: I3124c587ccb1c457df25fd5bf7a47feab9312a38
} else {
// segment we don't care about, so skip
$size = wfUnpack( "nint", fread( $fh, 2 ), 2 );
} else {
// segment we don't care about, so skip
$size = wfUnpack( "nint", fread( $fh, 2 ), 2 );
- if ( $size['int'] <= 2 ) {
+ if ( $size['int'] < 2 ) {
throw new MWException( "invalid marker size in jpeg" );
}
fseek( $fh, $size['int'] - 2, SEEK_CUR );
throw new MWException( "invalid marker size in jpeg" );
}
fseek( $fh, $size['int'] - 2, SEEK_CUR );
*/
private static function jpegExtractMarker( &$fh ) {
$size = wfUnpack( "nint", fread( $fh, 2 ), 2 );
*/
private static function jpegExtractMarker( &$fh ) {
$size = wfUnpack( "nint", fread( $fh, 2 ), 2 );
- if ( $size['int'] <= 2 ) {
+ if ( $size['int'] < 2 ) {
throw new MWException( "invalid marker size in jpeg" );
}
throw new MWException( "invalid marker size in jpeg" );
}
+ if ( $size['int'] === 2 ) {
+ // fread( ..., 0 ) generates a warning
+ return '';
+ }
$segment = fread( $fh, $size['int'] - 2 );
if ( strlen( $segment ) !== $size['int'] - 2 ) {
throw new MWException( "Segment shorter than expected" );
$segment = fread( $fh, $size['int'] - 2 );
if ( strlen( $segment ) !== $size['int'] - 2 ) {
throw new MWException( "Segment shorter than expected" );