- Slightly redesign

# More to follow, explanation follows at more public place

ext/standard/image.c

@@ -866,38 +866,41 @@ static struct gfxinfo *php_handle_iff(php_stream * stream TSRMLS_DC)
 	int chunkId;
 	int size;
 
-	if (php_stream_read(stream, a, 8) != 8)
+	if (php_stream_read(stream, a, 8) != 8) {
 		return NULL;
-	if (strncmp(a+4, "ILBM", 4) && strncmp(a+4, "PBM ", 4))
+	}
+	if (strncmp(a+4, "ILBM", 4) && strncmp(a+4, "PBM ", 4)) {
 		return NULL;
-
-	result = (struct gfxinfo *) ecalloc(1, sizeof(struct gfxinfo));
+	}
 
 	/* loop chunks to find BMHD chunk */
 	do {
 		if (php_stream_read(stream, a, 8) != 8) {
-			efree(result);
 			return NULL;
 		}
 		chunkId = php_ifd_get32s(a+0, 1);
 		size    = php_ifd_get32s(a+4, 1);
+		if (size < 0) {
+			return NULL;
+		}
 		if ((size & 1) == 1) {
 			size++;
 		}
 		if (chunkId == 0x424d4844) { /* BMHD chunk */
 			if (php_stream_read(stream, a, 9) != 9) {
-				efree(result);
 				return NULL;
 			}
+			result = (struct gfxinfo *) ecalloc(1, sizeof(struct gfxinfo));
 			result->width    = php_ifd_get16s(a+0, 1);
 			result->height   = php_ifd_get16s(a+2, 1);
 			result->bits     = a[8] & 0xff;
 			result->channels = 0;
-			if (result->width > 0 && result->height > 0 && result->bits > 0 && result->bits < 33)
+			if (result->width > 0 && result->height > 0 && result->bits > 0 && result->bits < 33) {
 				return result;
+			}
+			efree(result);
 		} else {
 			if (php_stream_seek(stream, size, SEEK_CUR)) {
-				efree(result);
 				return NULL;
 			}
 		}