diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-19 14:20:04 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-19 14:20:04 +0200 |
| commit | 6bf5c8508a2907fc840316075366991848a91e97 (patch) | |
| tree | c2bcc8b5a6683b984429fca77a7de6273b0b07fa | |
| parent | f53b8268d6085b6978e5897a4a313c085d664ebf (diff) | |
| parent | 3e139a465333d3b2bed4d23e42316ea952d96dd8 (diff) | |
| download | php-git-6bf5c8508a2907fc840316075366991848a91e97.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
| -rw-r--r-- | ext/exif/exif.c | 4 | ||||
| -rw-r--r-- | ext/exif/tests/duplicate_copyright_tag_leak.phpt | 12 | ||||
| -rw-r--r-- | ext/exif/tests/duplicate_copyright_tag_leak.tiff | bin | 0 -> 9397 bytes |
3 files changed, 16 insertions, 0 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index ebe2655daa..f12dbae393 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3391,6 +3391,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) { if (length<byte_count-1) { /* When there are any characters after the first NUL */ + EFREE_IF(ImageInfo->CopyrightPhotographer); + EFREE_IF(ImageInfo->CopyrightEditor); + EFREE_IF(ImageInfo->Copyright); ImageInfo->CopyrightPhotographer = estrdup(value_ptr); ImageInfo->CopyrightEditor = estrndup(value_ptr+length+1, byte_count-length-1); spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor); @@ -3398,6 +3401,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha /* but we are not supposed to change this */ /* keep in mind that image_info does not store editor value */ } else { + EFREE_IF(ImageInfo->Copyright); ImageInfo->Copyright = estrndup(value_ptr, byte_count); } } diff --git a/ext/exif/tests/duplicate_copyright_tag_leak.phpt b/ext/exif/tests/duplicate_copyright_tag_leak.phpt new file mode 100644 index 0000000000..c5d5019794 --- /dev/null +++ b/ext/exif/tests/duplicate_copyright_tag_leak.phpt @@ -0,0 +1,12 @@ +--TEST-- +OSS-Fuzz #17474: Memory leak on duplicate Copyright tags +--FILE-- +<?php + +// Only checking for an absence of leaks here. +@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff'); + +?> +===DONE=== +--EXPECTF-- +===DONE=== diff --git a/ext/exif/tests/duplicate_copyright_tag_leak.tiff b/ext/exif/tests/duplicate_copyright_tag_leak.tiff Binary files differnew file mode 100644 index 0000000000..48c7fe61ff --- /dev/null +++ b/ext/exif/tests/duplicate_copyright_tag_leak.tiff |