mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1: Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
This commit is contained in:
commit
dc1d99e772
@ -3947,6 +3947,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
|
||||
if (c == 0xFF)
|
||||
return FALSE;
|
||||
marker = c;
|
||||
if (pos>=ImageInfo->Thumbnail.size)
|
||||
return FALSE;
|
||||
length = php_jpg_get16(data+pos);
|
||||
if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
|
||||
return FALSE;
|
||||
|
BIN
ext/exif/tests/bug77988.jpg
Normal file
BIN
ext/exif/tests/bug77988.jpg
Normal file
Binary file not shown.
11
ext/exif/tests/bug77988.phpt
Normal file
11
ext/exif/tests/bug77988.phpt
Normal file
@ -0,0 +1,11 @@
|
||||
--TEST--
|
||||
Bug #77988 (heap-buffer-overflow on php_jpg_get16)
|
||||
--SKIPIF--
|
||||
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
|
||||
--FILE--
|
||||
<?php
|
||||
exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE);
|
||||
?>
|
||||
DONE
|
||||
--EXPECTF--
|
||||
DONE
|
Loading…
Reference in New Issue
Block a user