php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #79945: Stream wrappers in imagecreatefrompng causes segfault

Browse Source 
Closes GH-12696
This commit is contained in:
Jakub Zelenka
2023-11-16 20:42:05 +00:00
parent c442a1f18e
commit 6734880ef5
4 changed files with 39 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
NEWS
View File

@@ -11,6 +11,10 @@ PHP NEWS
- PHPDBG:
. Fixed bug GH-12675 (MEMORY_LEAK in phpdbg_prompt.c). (nielsdos)
- SQLite3:
. Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
(SakiTakamachi)
- Standard:
. Fix memory leak in syslog device handling. (danog)
. Fixed bug GH-12621 (browscap segmentation fault when configured in the
@@ -18,9 +22,9 @@ PHP NEWS
. Fixed bug GH-12655 (proc_open() does not take into account references
in the descriptor array). (nielsdos)
- SQLite3:
. Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
(SakiTakamachi)
- Streams:
. Fixed bug #79945 (Stream wrappers in imagecreatefrompng causes segfault).
(Jakub Zelenka)
- Zip:
. Fixed bug GH-12661 (Inconsistency in ZipArchive::addGlob remove_path Option

22
ext/gd/tests/bug79945.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
Bug #79945 (using php wrappers in imagecreatefrompng causes segmentation fault)
--EXTENSIONS--
gd
--SKIPIF--
<?php
set_error_handler(function($errno, $errstr) {
if (str_contains($errstr, 'Cannot cast a filtered stream on this system')) {
die('skip: fopencookie not support on this system');
}
});
imagecreatefrompng('php://filter/read=convert.base64-encode/resource=' . __DIR__ . '/test.png');
restore_error_handler();
?>
--FILE--
<?php
imagecreatefrompng('php://filter/read=convert.base64-encode/resource=' . __DIR__ . '/test.png');
?>
--CLEAN--
--EXPECTF--
Warning: imagecreatefrompng(): "php://filter/read=convert.base64-encode/resource=%s" is not a valid PNG file in %s on line %d

3
main/php_streams.h
View File

@@ -211,6 +211,9 @@ struct _php_stream {
* PHP_STREAM_FCLOSE_XXX as appropriate */
uint8_t fclose_stdiocast:2;
/* whether stdio cast flushing is in progress */
int8_t fclose_stdiocast_flush_in_progress:1;
char mode[16]; /* "rwb" etc. ala stdio */
uint32_t flags; /* PHP_STREAM_FLAG_XXX */

9
main/streams/streams.c
View File

@@ -1294,8 +1294,13 @@ PHPAPI zend_off_t _php_stream_tell(php_stream *stream)
PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
{
if (stream->fclose_stdiocast == PHP_STREAM_FCLOSE_FOPENCOOKIE) {
/* flush to commit data written to the fopencookie FILE* */
fflush(stream->stdiocast);
/* flush can call seek internally so we need to prevent an infinite loop */
if (!stream->fclose_stdiocast_flush_in_progress) {
stream->fclose_stdiocast_flush_in_progress = 1;
/* flush to commit data written to the fopencookie FILE* */
fflush(stream->stdiocast);
stream->fclose_stdiocast_flush_in_progress = 0;
}
}
/* handle the case where we are in the buffer */