mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2: Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG
This commit is contained in:
commit
66b32f25d5
@ -3277,7 +3277,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
|
||||
offset_base is ImageInfo->file.list[sn].data-dir_offset
|
||||
dir_entry - offset_base is dir_offset+2+i*12
|
||||
*/
|
||||
if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
|
||||
if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {
|
||||
/* It is important to check for IMAGE_FILETYPE_TIFF
|
||||
* JPEG does not use absolute pointers instead its pointers are
|
||||
* relative to the start of the TIFF header in APP1 section. */
|
||||
|
12
ext/exif/tests/bug77950.phpt
Normal file
12
ext/exif/tests/bug77950.phpt
Normal file
@ -0,0 +1,12 @@
|
||||
--TEST--
|
||||
Bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG)
|
||||
--SKIPIF--
|
||||
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
|
||||
--FILE--
|
||||
<?php
|
||||
exif_read_data(__DIR__."/bug77950.tiff");
|
||||
?>
|
||||
DONE
|
||||
--EXPECTF--
|
||||
%A
|
||||
DONE
|
BIN
ext/exif/tests/bug77950.tiff
Normal file
BIN
ext/exif/tests/bug77950.tiff
Normal file
Binary file not shown.
Loading…
Reference in New Issue
Block a user