1
0
mirror of https://github.com/php/php-src.git synced 2026-04-13 02:52:48 +02:00

Fix #79877: getimagesize function silently truncates after a null byte

We have to check for NUL bytes if `getimagesize()` has been called.
This commit is contained in:
Christoph M. Becker
2020-07-21 11:07:43 +02:00
committed by Stanislav Malyshev
parent 7355ab8176
commit ff577b04c0
2 changed files with 14 additions and 0 deletions

View File

@@ -1478,6 +1478,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
Z_PARAM_ZVAL_DEREF(info)
ZEND_PARSE_PARAMETERS_END();
if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
php_error_docref(NULL, E_WARNING, "Invalid path");
return;
}
if (argc == 2) {
zval_ptr_dtor(info);
array_init(info);

View File

@@ -0,0 +1,9 @@
--TEST--
Bug #79877 (getimagesize function silently truncates after a null byte)
--FILE--
<?php
var_dump(getimagesize("/tmp/a.png\0xx"));
?>
--EXPECTF--
Warning: getimagesize(): Invalid path in %s on line %d
NULL