mirror of
https://github.com/php/php-src.git
synced 2026-04-16 20:41:18 +02:00
d2274b01cb
GD2 stores the number of horizontal and vertical chunks as words (i.e. 2 byte unsigned). These values are multiplied and assigned to an int when reading the image, what can cause integer overflows. We have to avoid that, and also make sure that either chunk count is actually greater than zero. If illegal chunk counts are detected, we bail out from reading the image. (cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1)
19 lines
531 B
PHP
19 lines
531 B
PHP
--TEST--
|
|
Bug #73869 (Signed Integer Overflow gd_io.c)
|
|
--SKIPIF--
|
|
<?php
|
|
if (!extension_loaded('gd')) die('skip gd extension not available');
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869a.gd2'));
|
|
var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869b.gd2'));
|
|
?>
|
|
===DONE===
|
|
--EXPECTF--
|
|
Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
|
|
bool(false)
|
|
|
|
Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
|
|
bool(false)
|
|
===DONE===
|