# Out of bound read in exif_process_IFD_in_MAKERNOTE

PHP exif_process_IFD_in_MAKERNOTE computes offset_base from unchecked Canon maker-note offset and NumDirEntries, pushing the pointer past the buffer and causing an out-of-bounds read.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2016-08-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/152231
- Library page: https://bugbountylibrary.com/r/h1%3A152231
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP ext/exif exif_process_IFD_in_MAKERNOTE parsing JPEG EXIF maker notes
**Root cause:** In MN_OFFSET_GUESS mode, offset_diff is computed as 2+NumDirEntries*12+4 minus an attacker-controlled 32-bit value read from dir_start+10, with no validation that the resulting offset_base stays within the buffer.
**Steps:**
1. Craft a JPEG with a Canon maker note whose IFD entry count and the 32-bit value at dir_start+10 make offset_diff large.
2. Call `exif_read_data('exif/gen.jpg')` in PHP 7.0.4.
3. In gdb, break at exif.c:2754 and observe offset_diff computed from php_ifd_get32u(dir_start+10).
4. Step past `offset_base = value_ptr + offset_diff;` and observe offset_base (0x7ffff3e76600) lies beyond the end of the original buffer (0x7ffff3e76598).
**How found:** Code review of exif_process_IFD_in_MAKERNOTE spotted that the return of php_ifd_get32u(dir_start+10) and NumDirEntries are used to compute offset_diff without bounds checks; confirmed with a crafted JPEG under gdb.
**Exploitation:** A malicious JPEG fed to exif_read_data causes offset_base to point outside the allocated buffer; subsequent IFD parsing reads out-of-bounds memory, potentially leaking data or corrupting memory.
**Insight:** Maker-note offset-correction modes (MN_OFFSET_GUESS) trust both the directory entry count and an embedded 32-bit offset; fuzz these paired fields together since each alone passes the size check.