diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-03-02 15:07:40 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-03-03 18:35:43 -0800 |
| commit | 8ac6fee8562533a15db90062117210ed28b44fea (patch) | |
| tree | 50633647188a54e11fc6e1543789142fdc7210ab | |
| parent | 5f0e62a3e5b525163e538aaab0161c2c8c5d057b (diff) | |
| download | php-git-8ac6fee8562533a15db90062117210ed28b44fea.tar.gz | |
Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
Also fix for bug #77659
| -rw-r--r-- | ext/exif/exif.c | 3 | ||||
| -rw-r--r-- | ext/exif/tests/bug77563.jpg | bin | 0 -> 63 bytes | |||
| -rw-r--r-- | ext/exif/tests/bug77563.phpt | 16 |
3 files changed, 18 insertions, 1 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index ea88a8f115..fe89b85471 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2741,7 +2741,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu break; } - if (maker_note->offset >= value_len) { + if (value_len < 2 || maker_note->offset >= value_len - 1) { /* Do not go past the value end */ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset); return FALSE; @@ -2794,6 +2794,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu break; default: case MN_OFFSET_NORMAL: + data_len = value_len; break; } diff --git a/ext/exif/tests/bug77563.jpg b/ext/exif/tests/bug77563.jpg Binary files differnew file mode 100644 index 0000000000..d6280151f0 --- /dev/null +++ b/ext/exif/tests/bug77563.jpg diff --git a/ext/exif/tests/bug77563.phpt b/ext/exif/tests/bug77563.phpt new file mode 100644 index 0000000000..c14588664b --- /dev/null +++ b/ext/exif/tests/bug77563.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php +$s = exif_thumbnail(__DIR__."/bug77563.jpg"); +?> +DONE +--EXPECTF-- +Warning: exif_thumbnail(bug77563.jpg): Illegal IFD offset in %s/bug77563.php on line %d + +Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s/bug77563.php on line %d + +Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s/bug77563.php on line %d +DONE
\ No newline at end of file |
