diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-09-28 16:57:42 -0700 |
|---|---|---|
| committer | Julien Pauli <jpauli@php.net> | 2014-10-15 11:45:54 +0200 |
| commit | d0a6b7d1242bab3ebd4f1687bfa56b01e6767f67 (patch) | |
| tree | 91027e92abe36ecd5a6470d9fdb16576fa2b2f7e | |
| parent | cc1fe72bc99ae92d2e14275fd97f34960db24032 (diff) | |
| download | php-git-d0a6b7d1242bab3ebd4f1687bfa56b01e6767f67.tar.gz | |
Fix bug #68113 (Heap corruption in exif_thumbnail())
| -rw-r--r-- | ext/curl/interface.c | 2 | ||||
| -rw-r--r-- | ext/exif/exif.c | 4 | ||||
| -rwxr-xr-x | ext/exif/tests/bug68113.jpg | bin | 0 -> 368 bytes | |||
| -rw-r--r-- | ext/exif/tests/bug68113.phpt | 17 |
4 files changed, 20 insertions, 3 deletions
diff --git a/ext/curl/interface.c b/ext/curl/interface.c index eab2edf663..a48e8a3c06 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -171,7 +171,7 @@ static int php_curl_option_str(php_curl *ch, long option, const char *str, const if (strlen(str) != len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)"); - return 0; + return FAILURE; } #if LIBCURL_VERSION_NUM >= 0x071100 diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 38907b4d94..637ebf9289 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel data_ptr += 8; break; case TAG_FMT_SINGLE: - memmove(data_ptr, &info_data->value.f, byte_count); + memmove(data_ptr, &info_value->f, 4); data_ptr += 4; break; case TAG_FMT_DOUBLE: - memmove(data_ptr, &info_data->value.d, byte_count); + memmove(data_ptr, &info_value->d, 8); data_ptr += 8; break; } diff --git a/ext/exif/tests/bug68113.jpg b/ext/exif/tests/bug68113.jpg Binary files differnew file mode 100755 index 0000000000..3ce7a620fb --- /dev/null +++ b/ext/exif/tests/bug68113.jpg diff --git a/ext/exif/tests/bug68113.phpt b/ext/exif/tests/bug68113.phpt new file mode 100644 index 0000000000..0fa4c4aca8 --- /dev/null +++ b/ext/exif/tests/bug68113.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #68113 (Heap corruption in exif_thumbnail()) +--SKIPIF-- +<?php +extension_loaded("exif") or die("skip need exif"); +?> +--FILE-- +<?php +var_dump(exif_thumbnail(__DIR__."/bug68113.jpg")); +?> +Done +--EXPECTF-- +Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2 + +Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2 +bool(false) +Done
\ No newline at end of file |
