php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-26 17:38:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.1' into PHP-7.2

Browse Source 
* PHP-7.1:
  Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
This commit is contained in:
Stanislav Malyshev
2019-05-27 17:28:20 -07:00
parent 9bca9ef6cf 73ff4193be
commit dc1d99e772
3 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/exif/exif.c
+2
View File
@@ -3947,6 +3947,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
if (c == 0xFF)
return FALSE;
marker = c;
if (pos>=ImageInfo->Thumbnail.size)
return FALSE;
length = php_jpg_get16(data+pos);
if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
return FALSE;
ext/exif/tests/bug77988.jpg
BIN
View File
Binary file not shown.
ext/exif/tests/bug77988.phpt
+11
View File
@@ -0,0 +1,11 @@
--TEST--
Bug #77988 (heap-buffer-overflow on php_jpg_get16)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE);
?>
DONE
--EXPECTF--
DONE