diff options
| author | Remi Collet <remi@php.net> | 2014-12-13 09:05:33 +0100 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2014-12-13 09:05:33 +0100 |
| commit | 8bd67ce748c420078076d5c04463b5779159f58a (patch) | |
| tree | c8f774bc99408dfe98f081c7e5b04b70621d5023 | |
| parent | 3769aee67c19647041567b82a76d2d46955f47aa (diff) | |
| parent | ba62b9bbf87635e5d12546c426324e095cb1a0bb (diff) | |
| download | php-git-8bd67ce748c420078076d5c04463b5779159f58a.tar.gz | |
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
NEWS
Fix bug #68601 buffer read overflow in gd_gif_in.c
| -rw-r--r-- | ext/gd/libgd/gd_gif_in.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c index ee88a2fc8e..491e9422db 100644 --- a/ext/gd/libgd/gd_gif_in.c +++ b/ext/gd/libgd/gd_gif_in.c @@ -72,8 +72,10 @@ static struct { #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2) +#define CSD_BUF_SIZE 280 + typedef struct { - unsigned char buf[280]; + unsigned char buf[CSD_BUF_SIZE]; int curbit, lastbit, done, last_byte; } CODE_STATIC_DATA; @@ -400,7 +402,12 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD ret = 0; for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) - ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j; + if (i < CSD_BUF_SIZE * 8) { + ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j; + } else { + ret = -1; + break; + } scd->curbit += code_size; return ret; |