Fix phpGH-20201: AVIF images misdetected as HEIF after introducing HEIF support in getimagesize()

Closes phpGH-20234.

Author: ndossche

NEWS

@@ -19,6 +19,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug GH-20257 (mail() heap overflow with an empty message in lf mode).
     (David Carlier)
+  . Fixed bug GH-20201 (AVIF images misdetected as HEIF after introducing HEIF
+    support in getimagesize()). (nielsdos)
 
 - Streams:
   . Fixed bug GH-19798: XP_SOCKET XP_SSL (Socket stream modules): Incorrect

ext/standard/image.c

@@ -1435,15 +1435,16 @@ PHPAPI int php_getimagetype(php_stream *stream, const char *input, char *filetyp
 		return IMAGE_FILETYPE_JP2;
 	}
 
+	if (!php_stream_rewind(stream) && php_is_image_avif(stream)) {
+		return IMAGE_FILETYPE_AVIF;
+	}
+
+	/* See GH-20201: this needs to be after avif checks to avoid identifying avif as heif. */
 	if (twelve_bytes_read && !memcmp(filetype + 4, php_sig_ftyp, 4) &&
 		(!memcmp(filetype + 8, php_sig_mif1, 4) || !memcmp(filetype + 8, php_sig_heic, 4) || !memcmp(filetype + 8, php_sig_heix, 4))) {
 		return IMAGE_FILETYPE_HEIF;
 	}
 
-	if (!php_stream_rewind(stream) && php_is_image_avif(stream)) {
-		return IMAGE_FILETYPE_AVIF;
-	}
-
 /* AFTER ALL ABOVE FAILED */
 	if (php_get_wbmp(stream, NULL, 1)) {
 		return IMAGE_FILETYPE_WBMP;

ext/standard/tests/image/gh20201.avif

@@ -0,0 +1,27 @@
+--TEST--
+GH-20201 (AVIF images misdetected as HEIF after introducing HEIF support in getimagesize())
+--FILE--
+<?php
+var_dump(getimagesize(__DIR__ . '/gh20201.avif'));
+?>
+--EXPECT--
+array(9) {
+  [0]=>
+  int(8)
+  [1]=>
+  int(8)
+  [2]=>
+  int(19)
+  [3]=>
+  string(20) "width="8" height="8""
+  ["bits"]=>
+  int(8)
+  ["channels"]=>
+  int(3)
+  ["mime"]=>
+  string(10) "image/avif"
+  ["width_unit"]=>
+  string(2) "px"
+  ["height_unit"]=>
+  string(2) "px"
+}