mirror of
https://github.com/php/php-src.git
synced 2026-03-28 18:22:42 +01:00
5cd348c1d6
Crafted BMP images can cause dynamicSeek() to be called with a negative position which must not be allowed, since dynamicSeek() works like fseek() in SEEK_SET mode. We solve this by bailing out if `pos` is negative, and let the image reading fail gracefully.
26 lines
773 B
PHP
26 lines
773 B
PHP
--TEST--
|
|
Bug #75111 (Memory disclosure or DoS via crafted .bmp image)
|
|
--SKIPIF--
|
|
<?php
|
|
if (!extension_loaded('gd')) die('skip gd extension not available');
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
// craft BMP image
|
|
$str = hex2bin("424D3603000000000000");
|
|
$str .= pack("V", -0x120000); // offset of image data
|
|
$str .= pack("V", 40); // length of header
|
|
$str .= pack("V", 256); // width
|
|
$str .= pack("V", 256); // height
|
|
$str .= hex2bin("01001800000000000000000000000000000000000000000000000000");
|
|
|
|
var_dump(imagecreatefromstring($str));
|
|
?>
|
|
===DONE===
|
|
--EXPECTF--
|
|
Warning: imagecreatefromstring(): Passed data is not in 'BMP' format in %s on line %d
|
|
|
|
Warning: imagecreatefromstring(): Couldn't create GD Image Stream out of Data in %s on line %d
|
|
bool(false)
|
|
===DONE===
|