php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-11 01:53:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix #81739: OOB read due to insufficient validation in imageloadfont()

Browse Source 
If we swap the byte order of the relevant header bytes, we need to make
sure again that the following multiplication does not overflow.
This commit is contained in:
Christoph M. Becker
2022-10-18 12:13:16 +02:00
committed by Gabriel Caruso
parent b7cbb6c53f
commit feb586e60a
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ext/gd/gd.c
View File

@@ -686,6 +686,12 @@ PHP_FUNCTION(imageloadfont)
font->w = FLIPWORD(font->w);
font->h = FLIPWORD(font->h);
font->nchars = FLIPWORD(font->nchars);
if (overflow2(font->nchars, font->h) || overflow2(font->nchars * font->h, font->w )) {
php_error_docref(NULL, E_WARNING, "Error reading font, invalid font header");
efree(font);
php_stream_close(stream);
RETURN_FALSE;
}
body_size = font->w * font->h * font->nchars;
}
@@ -696,6 +702,7 @@ PHP_FUNCTION(imageloadfont)
RETURN_FALSE;
}
ZEND_ASSERT(body_size > 0);
font->data = emalloc(body_size);
b = 0;
while (b < body_size && (n = php_stream_read(stream, &font->data[b], body_size - b)) > 0) {

24
ext/gd/tests/bug81739.phpt Normal file
View File

@@ -0,0 +1,24 @@
--TEST--
Bug #81739 (OOB read due to insufficient validation in imageloadfont())
--SKIPIF--
<?php
if (!extension_loaded("gd")) die("skip gd extension not available");
?>
--FILE--
<?php
$s = fopen(__DIR__ . "/font.font", "w");
// header without character data
fwrite($s, "\x01\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x08\x00\x00\x00");
fclose($s);
var_dump(imageloadfont(__DIR__ . "/font.font"));
?>
--CLEAN--
<?php
@unlink(__DIR__ . "/font.font");
?>
--EXPECTF--
Warning: imageloadfont(): %croduct of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
in %s on line %d
Warning: imageloadfont(): Error reading font, invalid font header in %s on line %d
bool(false)