review: p[0] OOB

Author: ndossche

ext/exif/exif.c

@@ -4333,9 +4333,8 @@ static void exif_isobmff_parse_meta(unsigned char *data, unsigned char *end, iso
 		remain = end - p;
 
 		if (box.type == FOURCC("iinf")) {
-			ADVANCE(header_size);
-			version = p[0];
-			ADVANCE(4);
+			ADVANCE(header_size + 4);
+			version = p[-4];
 			if (version < 2) {
 				ADVANCE(2);
 				item_count = php_ifd_get16u(p - 2, 1);
@@ -4360,9 +4359,8 @@ static void exif_isobmff_parse_meta(unsigned char *data, unsigned char *end, iso
 			}
 		}
 		else if (box.type == FOURCC("iloc")) {
-			ADVANCE(header_size);
-			version = p[0];
-			ADVANCE(6);
+			ADVANCE(header_size + 6);
+			version = p[-6];
 			if (version < 2) {
 				ADVANCE(2);
 				item_count = php_ifd_get16u(p - 2, 1);