diff options
| author | Pierre Joye <pajoye@php.net> | 2011-02-14 09:08:44 +0000 |
|---|---|---|
| committer | Pierre Joye <pajoye@php.net> | 2011-02-14 09:08:44 +0000 |
| commit | 0f842f667aef662dfa6cc487b18d1dd92b8fdedb (patch) | |
| tree | 80e980636873fa48a2f972e0c0c7fda34739e8e6 /ext/exif/exif.c | |
| parent | ac057c610cbdce68ed3de5d7e4dfd5907dcb6f49 (diff) | |
| download | php-git-0f842f667aef662dfa6cc487b18d1dd92b8fdedb.tar.gz | |
- fix bug #54002, exif_read_data crashes on crafted tags
Diffstat (limited to 'ext/exif/exif.c')
| -rw-r--r-- | ext/exif/exif.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index d5f051d423..289dd2f1d7 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -40,6 +40,10 @@ #include "php.h" #include "ext/standard/file.h" +#ifdef PHP_WIN32 +include "win32/php_stdint.h" +#endif + #if HAVE_EXIF /* When EXIF_DEBUG is defined the module generates a lot of debug messages @@ -2821,6 +2825,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha int tag, format, components; char *value_ptr, tagname[64], cbuf[32], *outside=NULL; size_t byte_count, offset_val, fpos, fgot; + int64_t byte_count_signed; xp_field_type *tmp_xp; #ifdef EXIF_DEBUG char *dump_data; @@ -2845,13 +2850,20 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha /*return TRUE;*/ } - byte_count = components * php_tiff_bytes_per_format[format]; + if (components < 0) { + exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), byte_count); + return FALSE; + } + + byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format]; - if ((ssize_t)byte_count < 0) { + if (byte_count_signed < 0 || (byte_count_signed > 2147483648)) { exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), byte_count); return FALSE; } + byte_count = (size_t)byte_count_signed; + if (byte_count > 4) { offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel); /* If its bigger than 4 bytes, the dir entry contains an offset. */ @@ -2916,6 +2928,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha efree(dump_data); } #endif + if (section_index==SECTION_THUMBNAIL) { if (!ImageInfo->Thumbnail.data) { switch(tag) { |