diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-05-27 17:28:25 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-05-27 17:28:25 -0700 |
| commit | 13dffa9d32ccd0a167956adb49429d71252c6a02 (patch) | |
| tree | 1f9d4e4f88d286ce20eebe7926a20e4c8c13b5e0 /ext | |
| parent | e63b2ba310cc5104481e6fc5e8210121f7d45b2c (diff) | |
| parent | dc1d99e772ce82b180e4c15d63ce70331eebfab7 (diff) | |
| download | php-git-13dffa9d32ccd0a167956adb49429d71252c6a02.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/exif/exif.c | 2 | ||||
| -rw-r--r-- | ext/exif/tests/bug77988.jpg | bin | 0 -> 1202 bytes | |||
| -rw-r--r-- | ext/exif/tests/bug77988.phpt | 11 |
3 files changed, 13 insertions, 0 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 78269b9a92..e04290376c 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3920,6 +3920,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo) if (c == 0xFF) return FALSE; marker = c; + if (pos>=ImageInfo->Thumbnail.size) + return FALSE; length = php_jpg_get16(data+pos); if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) { return FALSE; diff --git a/ext/exif/tests/bug77988.jpg b/ext/exif/tests/bug77988.jpg Binary files differnew file mode 100644 index 0000000000..120ff8565a --- /dev/null +++ b/ext/exif/tests/bug77988.jpg diff --git a/ext/exif/tests/bug77988.phpt b/ext/exif/tests/bug77988.phpt new file mode 100644 index 0000000000..1632c8afaa --- /dev/null +++ b/ext/exif/tests/bug77988.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #77988 (heap-buffer-overflow on php_jpg_get16) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php +exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE); +?> +DONE +--EXPECTF-- +DONE
\ No newline at end of file |
