clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 02:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3' into PHP-7.4

Browse Source
This commit is contained in:
Nikita Popov 2019-09-22 10:27:07 +02:00
commit 0508a70640
3 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ext/exif/exif.c
View File

@ -2296,14 +2296,11 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
efree(f);
}
switch(image_info->info_list[section_index].list[i].format) {
case TAG_FMT_SBYTE:
case TAG_FMT_BYTE:
/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
if (image_info->info_list[section_index].list[i].length<1)
break;
default:
case TAG_FMT_UNDEFINED:
case TAG_FMT_STRING:
case TAG_FMT_SBYTE:
case TAG_FMT_BYTE:
default:
if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
efree(f);
}
@ -3458,9 +3455,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
break;
case TAG_MAKE:
EFREE_IF(ImageInfo->make);
ImageInfo->make = estrndup(value_ptr, byte_count);
break;
case TAG_MODEL:
EFREE_IF(ImageInfo->model);
ImageInfo->model = estrndup(value_ptr, byte_count);
break;

11
ext/exif/tests/zero_length_makernote_leak.phpt Normal file
View File

@ -0,0 +1,11 @@
--TEST--
OSS-Fuzz: Memory leak for zero-length MAKERNOTE
--FILE--
<?php
@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
?>
===DONE===
--EXPECT--
===DONE===

BIN
ext/exif/tests/zero_length_makernote_leak.tiff Normal file
View File

Binary file not shown.