php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-24 16:38:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3' into PHP-7.4

Browse Source
This commit is contained in:
Nikita Popov
2019-09-19 21:14:46 +02:00
parent 3fd68fd827 e76dea4283
commit f0f84adf2b
4 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/exif/exif.c
+20
View File
@@ -3171,6 +3171,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
}
/* }}} */
#define REQUIRE_NON_EMPTY() do { \
if (byte_count == 0) { \
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
return FALSE; \
} \
} while (0)
/* {{{ exif_process_IFD_TAG
* Process one of the nested IFDs directories. */
static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3288,8 +3296,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
}
#endif
/* NB: The following code may not assume that there is at least one component!
* byte_count may be zero! */
if (section_index==SECTION_THUMBNAIL) {
if (!ImageInfo->Thumbnail.data) {
REQUIRE_NON_EMPTY();
switch(tag) {
case TAG_IMAGEWIDTH:
case TAG_COMP_IMAGE_WIDTH:
@@ -3372,6 +3384,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
case TAG_FNUMBER:
/* Simplest way of expressing aperture, so I trust it the most.
(overwrite previously computed value if there is one) */
REQUIRE_NON_EMPTY();
ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
break;
@@ -3380,6 +3393,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
/* More relevant info always comes earlier, so only use this field if we don't
have appropriate aperture information yet. */
if (ImageInfo->ApertureFNumber == 0) {
REQUIRE_NON_EMPTY();
ImageInfo->ApertureFNumber
= expf(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*logf(2.0)*0.5);
}
@@ -3391,6 +3405,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
SHUTTERSPEED comes after EXPOSURE TIME
*/
if (ImageInfo->ExposureTime == 0) {
REQUIRE_NON_EMPTY();
ImageInfo->ExposureTime
= expf(-exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*logf(2.0));
}
@@ -3400,20 +3415,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
break;
case TAG_COMP_IMAGE_WIDTH:
REQUIRE_NON_EMPTY();
ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
break;
case TAG_FOCALPLANE_X_RES:
REQUIRE_NON_EMPTY();
ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
break;
case TAG_SUBJECT_DISTANCE:
/* Inidcates the distacne the autofocus camera is focused to.
Tends to be less accurate as distance increases. */
REQUIRE_NON_EMPTY();
ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
break;
case TAG_FOCALPLANE_RESOLUTION_UNIT:
REQUIRE_NON_EMPTY();
switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
case 2:
@@ -3456,6 +3475,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
case TAG_GPS_IFD_POINTER:
case TAG_INTEROP_IFD_POINTER:
if (ReadNextIFD) {
REQUIRE_NON_EMPTY();
char *Subdir_start;
int sub_section_index = 0;
switch(tag) {
ext/exif/tests/bug73737.phpt
+2
View File
@@ -8,5 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
var_dump($exif);
?>
--EXPECTF--
Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d
Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
bool(false)
ext/exif/tests/tag_with_illegal_zero_components.jpeg
BIN
View File
Binary file not shown.
ext/exif/tests/tag_with_illegal_zero_components.phpt
+15
View File
@@ -0,0 +1,15 @@
--TEST--
OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
--FILE--
<?php
var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
?>
--EXPECTF--
Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
bool(false)