php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.5'

Browse Source 
* PHP-8.5:
  Fix GH-20631: Integer underflow in exif HEIF parsing
This commit is contained in:
Niels Dossche
2025-12-03 22:30:26 +01:00
parent d998a791da 6a0da6dc2e
commit 114260bdc4
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ext/exif/exif.c
View File

@@ -4421,7 +4421,7 @@ static bool exif_scan_HEIF_header(image_info_type *ImageInfo, unsigned char *buf
if (exif_read_from_stream_file_looped(ImageInfo->infile, (char*)(data + remain), limit - remain) == limit - remain) {
exif_isobmff_parse_meta(data, data + limit, &pos);
}
if ((pos.size) &&
if ((pos.size >= 2) &&
(pos.size < ImageInfo->FileSize) &&
(ImageInfo->FileSize - pos.size >= pos.offset) &&
(php_stream_seek(ImageInfo->infile, pos.offset + 2, SEEK_SET) >= 0)) {

19
ext/exif/tests/heic_iloc_underflow.phpt Normal file
View File

@@ -0,0 +1,19 @@
--TEST--
HEIC iloc extent_length underflow
--EXTENSIONS--
exif
--FILE--
<?php
// Read valid HEIC file and patch iloc extent_length to 1
$data = file_get_contents(__DIR__."/image029.heic");
$data = substr_replace($data, "\x00\x00\x00\x01", 0x4f8, 4);
file_put_contents(__DIR__."/heic_iloc_underflow.heic", $data);
var_dump(exif_read_data(__DIR__."/heic_iloc_underflow.heic"));
?>
--CLEAN--
<?php
@unlink(__DIR__."/heic_iloc_underflow.heic");
?>
--EXPECTF--
Warning: exif_read_data(heic_iloc_underflow.heic): Invalid HEIF file in %s on line %d
bool(false)