summaryrefslogtreecommitdiff
path: root/ext/gd
diff options
context:
space:
mode:
authorXinchen Hui <laruence@gmail.com>2018-01-02 13:49:58 +0800
committerXinchen Hui <laruence@gmail.com>2018-01-02 13:49:58 +0800
commitbd23bcec3ebd6dd805a657b43f8dd924f80b9641 (patch)
tree3819d13c867fe9144189954c8b302da18a60c7e9 /ext/gd
parentccd4716ec77c60391d63a1a6af72f96a09b1c617 (diff)
parent92c19f8a26d314ff23f3d2cee639c6b4862c4a11 (diff)
downloadphp-git-bd23bcec3ebd6dd805a657b43f8dd924f80b9641.tar.gz
Merge branch 'PHP-7.1' of git.php.net:/php-src into PHP-7.1
* 'PHP-7.1' of git.php.net:/php-src: Update NEWS Fixed bug #75571: Potential infinite loop in gdImageCreateFromGifCtx Fix bug #74782: remove file name from output to avoid XSS
Diffstat (limited to 'ext/gd')
-rw-r--r--ext/gd/libgd/gd_gif_in.c10
-rw-r--r--ext/gd/tests/bug75571.gifbin0 -> 1731 bytes
-rw-r--r--ext/gd/tests/bug75571.phpt15
3 files changed, 20 insertions, 5 deletions
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 76ba152035..7156e4b8e0 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -261,10 +261,6 @@ terminated:
if (!im) {
return 0;
}
- if (!im->colorsTotal) {
- gdImageDestroy(im);
- return 0;
- }
/* Check for open colors at the end, so
we can reduce colorsTotal and ultimately
BitsPerPixel */
@@ -275,6 +271,10 @@ terminated:
break;
}
}
+ if (!im->colorsTotal) {
+ gdImageDestroy(im);
+ return 0;
+ }
return im;
}
/* }}} */
@@ -375,7 +375,7 @@ static int
GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
{
int i, j, ret;
- unsigned char count;
+ int count;
if (flag) {
scd->curbit = 0;
diff --git a/ext/gd/tests/bug75571.gif b/ext/gd/tests/bug75571.gif
new file mode 100644
index 0000000000..3c30b40f28
--- /dev/null
+++ b/ext/gd/tests/bug75571.gif
Binary files differ
diff --git a/ext/gd/tests/bug75571.phpt b/ext/gd/tests/bug75571.phpt
new file mode 100644
index 0000000000..5bd26b84ec
--- /dev/null
+++ b/ext/gd/tests/bug75571.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===