diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-22 12:10:42 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-22 12:10:42 +0200 |
| commit | 9cd365e571e09b553e67a84b50496dd17adfe604 (patch) | |
| tree | a6541a8704a79bcb93e2bcf7884b7fb663daad43 | |
| parent | 623d89799802954fa0b91d1603fd653ccc2401fd (diff) | |
| parent | f989a4cd44f1bbabc6cdba9af1477125a8ba2f56 (diff) | |
| download | php-git-9cd365e571e09b553e67a84b50496dd17adfe604.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
| -rw-r--r-- | ext/exif/exif.c | 2 | ||||
| -rw-r--r-- | ext/exif/tests/temporary_buffer_leak.jpg | bin | 0 -> 46 bytes | |||
| -rw-r--r-- | ext/exif/tests/temporary_buffer_leak.phpt | 10 |
3 files changed, 12 insertions, 0 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index c5495ce681..2804807e0b 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3561,9 +3561,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel); if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) { exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer"); + EFREE_IF(outside); return FALSE; } if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) { + EFREE_IF(outside); return FALSE; } #ifdef EXIF_DEBUG diff --git a/ext/exif/tests/temporary_buffer_leak.jpg b/ext/exif/tests/temporary_buffer_leak.jpg Binary files differnew file mode 100644 index 0000000000..c9f7ce821f --- /dev/null +++ b/ext/exif/tests/temporary_buffer_leak.jpg diff --git a/ext/exif/tests/temporary_buffer_leak.phpt b/ext/exif/tests/temporary_buffer_leak.phpt new file mode 100644 index 0000000000..cf136dd648 --- /dev/null +++ b/ext/exif/tests/temporary_buffer_leak.phpt @@ -0,0 +1,10 @@ +--TEST-- +OSS-Fuzz: Temporary buffer leak in tag reading +--FILE-- +<?php + +var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg')); + +?> +--EXPECT-- +bool(false) |
