diff --git a/ext/exif/exif.c b/ext/exif/exif.c index d4506a9400d..80d773309c5 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3308,6 +3308,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) { if (lengthCopyrightPhotographer); + EFREE_IF(ImageInfo->CopyrightEditor); + EFREE_IF(ImageInfo->Copyright); ImageInfo->CopyrightPhotographer = estrdup(value_ptr); ImageInfo->CopyrightEditor = estrndup(value_ptr+length+1, byte_count-length-1); spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor); @@ -3315,6 +3318,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha /* but we are not supposed to change this */ /* keep in mind that image_info does not store editor value */ } else { + EFREE_IF(ImageInfo->Copyright); ImageInfo->Copyright = estrndup(value_ptr, byte_count); } } diff --git a/ext/exif/tests/duplicate_copyright_tag_leak.phpt b/ext/exif/tests/duplicate_copyright_tag_leak.phpt new file mode 100644 index 00000000000..c5d50197941 --- /dev/null +++ b/ext/exif/tests/duplicate_copyright_tag_leak.phpt @@ -0,0 +1,12 @@ +--TEST-- +OSS-Fuzz #17474: Memory leak on duplicate Copyright tags +--FILE-- + +===DONE=== +--EXPECTF-- +===DONE=== diff --git a/ext/exif/tests/duplicate_copyright_tag_leak.tiff b/ext/exif/tests/duplicate_copyright_tag_leak.tiff new file mode 100644 index 00000000000..48c7fe61ff0 Binary files /dev/null and b/ext/exif/tests/duplicate_copyright_tag_leak.tiff differ