clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 02:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.1' into PHP-7.2

Browse Source 
* PHP-7.1:
  Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
This commit is contained in:
Stanislav Malyshev 2019-05-27 17:28:20 -07:00
commit dc1d99e772
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/exif/exif.c
View File

@ -3947,6 +3947,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
if (c == 0xFF)
return FALSE;
marker = c;
if (pos>=ImageInfo->Thumbnail.size)
return FALSE;
length = php_jpg_get16(data+pos);
if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
return FALSE;

BIN
ext/exif/tests/bug77988.jpg Normal file
View File

Binary file not shown.

11
ext/exif/tests/bug77988.phpt Normal file
View File

@ -0,0 +1,11 @@
--TEST--
Bug #77988 (heap-buffer-overflow on php_jpg_get16)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE);
?>
DONE
--EXPECTF--
DONE