diff options
| author | Pierre Joye <pierre.php@gmail.com> | 2016-07-19 07:11:44 +0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-07-19 09:33:34 +0200 |
| commit | 7b1572b1772dc92b2e73b7cf6d51dca88a60f411 (patch) | |
| tree | a70680d22ad9e032442be73f9a33a10e35199741 | |
| parent | fe1d6feb3dfa1eebd69a82c8000d2095b4e8a531 (diff) | |
| download | php-git-7b1572b1772dc92b2e73b7cf6d51dca88a60f411.tar.gz | |
fix #72519, possible OOB using imagegif
fix #72519, possible OOB using imagegif
| -rw-r--r-- | ext/gd/libgd/gd_gif_out.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/ext/gd/libgd/gd_gif_out.c b/ext/gd/libgd/gd_gif_out.c index 14045385ab..0178dd9741 100644 --- a/ext/gd/libgd/gd_gif_out.c +++ b/ext/gd/libgd/gd_gif_out.c @@ -601,14 +601,26 @@ nomatch: * code in turn. When the buffer fills up empty it and start over. */ -static unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F, +static const unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F, 0x001F, 0x003F, 0x007F, 0x00FF, 0x01FF, 0x03FF, 0x07FF, 0x0FFF, 0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF }; + +/* Arbitrary value to mark output is done. When we see EOFCode, then we don't + * expect to see any more data. If we do (e.g. corrupt image inputs), cur_bits + * might be negative, so flag it to return early. + */ +#define CUR_BITS_FINISHED -1000 + + static void output(code_int code, GifCtx *ctx) { + if (ctx->cur_bits == CUR_BITS_FINISHED) { + return; + } + ctx->cur_accum &= masks[ ctx->cur_bits ]; if( ctx->cur_bits > 0 ) @@ -655,8 +667,10 @@ output(code_int code, GifCtx *ctx) ctx->cur_bits -= 8; } - flush_char(ctx); + /* Flag that it's done to prevent re-entry. */ + ctx->cur_bits = CUR_BITS_FINISHED; + flush_char(ctx); } } |