From e9090913230ef2a20e1bca8bae8a007a8e9a7274 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 10 Aug 2026 10:31:50 -0400
Subject: [PATCH] Bound the HEIF meta box allocation by the file size

exif_scan_HEIF_header() allocated box.size - box_header_size with only a
lower bound, so a 37-byte file could claim a 128MB meta box and force the
allocation before any read is attempted. The second allocation in the
same block is already bounded by pos.size < ImageInfo->FileSize; apply
the same bound to the first.

Closes GH-23201
---
 NEWS                                    |  4 ++++
 ext/exif/exif.c                         |  2 +-
 ext/exif/tests/heic_meta_box_alloc.phpt | 23 +++++++++++++++++++++++
 3 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 ext/exif/tests/heic_meta_box_alloc.phpt

diff --git a/NEWS b/NEWS
index ade754593071..667656365862 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
     with DOMNode::isEqualNode()). (Weilin Du)
 
+- Exif:
+  . Fixed exif_read_data() allocating a HEIF meta box larger than the file
+    it came from. (iliaal)
+
 - Intl:
   . Fixed IntlListFormatter::__construct() leaving stale global error state
     after successful calls. (Weilin Du)
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index b30644f155cf..a2eb8259ac71 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -4415,7 +4415,7 @@ static bool exif_scan_HEIF_header(image_info_type *ImageInfo, unsigned char *buf
 		}
 		if (box.type == FOURCC("meta")) {
 			limit = box.size - box_header_size;
-			if (limit < 36) {
+			if (limit < 36 || limit > ImageInfo->FileSize) {
 				break;
 			}
 			data = (unsigned char *)emalloc(limit);
diff --git a/ext/exif/tests/heic_meta_box_alloc.phpt b/ext/exif/tests/heic_meta_box_alloc.phpt
new file mode 100644
index 000000000000..ddc9e415b830
--- /dev/null
+++ b/ext/exif/tests/heic_meta_box_alloc.phpt
@@ -0,0 +1,23 @@
+--TEST--
+HEIC meta box size must be bounded by the file size
+--EXTENSIONS--
+exif
+--INI--
+memory_limit=32M
+--FILE--
+<?php
+// ftyp box (size 20) followed by a meta box whose size field claims 128MB,
+// in a file that is only 37 bytes. Without an upper bound the meta box
+// allocation exhausts memory_limit before any read is attempted.
+$ftyp = pack("N", 20) . "ftypheic" . str_repeat("\x00", 8);
+$meta = pack("N", 0x08000000) . "meta" . str_repeat("\x00", 8);
+file_put_contents(__DIR__."/heic_meta_box_alloc.heic", $ftyp . $meta . "\x00");
+var_dump(exif_read_data(__DIR__."/heic_meta_box_alloc.heic"));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__."/heic_meta_box_alloc.heic");
+?>
+--EXPECTF--
+Warning: exif_read_data(heic_meta_box_alloc.heic): Invalid HEIF file in %s on line %d
+bool(false)