[jorge-zopitech]

Pull request - SUBMITTED AS DRAFT

URL: #25200

Title: Fix HEIF EXIF extraction with variable-width iloc entries

Author: Jorge Moya A. - ZopiTech
GitHub: jorge-zopitech
Git commit email: jorge.moya@zopitech.cl
Target: php/php-src master
Source: jorge-zopitech:fix/exif-heif-iloc-variable-width
Commit: 0d7c9a6

Summary

PHP's EXIF HEIF parser assumes a fixed 16-byte stride for iloc
item records even though the box specifies variable widths for
the offset, length and base-offset fields. Valid HEIC files may
therefore fail to return Exif metadata via exif_read_data().

This change parses the declared field widths and extent_count,
performs bounded reads and integer overflow checks, and handles
iloc preceding iinf. The parser intentionally supports only
single-extent, local-file EXIF items when the result fits its
current offset and length representation.

Reproduction

An HEIC file encoded with libheif/x265 and tagged using ExifTool
is recognized by heif-info and ExifTool but PHP 8.5.12 returns
false from exif_read_data(). With this change, the same file
returns IFD0 Make and Model.

Tests

• 319 test fixtures, each run on original, bounds-only and patched
  PHP 8.5.12 builds: 957 isolated executions. No ASan/UBSan reports.
• 4 HEIC images encoded with x265: the patched parser extracts
  Make/Model from all 4; original PHP extracts none.
• An official PHPT regression test fails against the unpatched
  PHP 8.5.12 build and passes on the patched build.
• Built php-src master as PHP 8.7.0-dev, NTS DEBUG, ASan/UBSan.
• Official EXIF test suite from master: 108 tests total,
  104 passed, 4 skipped, 0 failures.
• The new heic_variable_iloc.phpt passes on patched master.

Scope

This fixes HEIF/HEIC EXIF compatibility. No RCE, corruption of
memory or vulnerability has been demonstrated.
Multi-extent and non-local construction methods are not covered.

Notes for reviewers

Please review the bounded parsing and supported iloc versions
(v0/v1/v2), including base offsets, extent counts and unusual
box ordering. The fixture files are locally generated, without
personal photographs or metadata.

Signed-off-by: Jorge Moya A. jorge.moya@zopitech.cl