diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-06 10:18:51 +0200 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-05-27 16:11:32 -0700 |
| commit | ed6dee9a198c904ad5e03113e58a2d2c200f5184 (patch) | |
| tree | 5d7e56a08d15c697c7f879c62fe1d8c6d20ba11d | |
| parent | f80ad18afae2230c2c1802c7d829100af646874e (diff) | |
| download | php-git-ed6dee9a198c904ad5e03113e58a2d2c200f5184.tar.gz | |
Fix #77973: Uninitialized read in gdImageCreateFromXbm
We have to ensure that `sscanf()` does indeed read a hex value here,
and bail out otherwise.
| -rw-r--r-- | ext/gd/libgd/xbm.c | 6 | ||||
| -rw-r--r-- | ext/gd/tests/bug77973.phpt | 26 |
2 files changed, 31 insertions, 1 deletions
diff --git a/ext/gd/libgd/xbm.c b/ext/gd/libgd/xbm.c index 6ff18cdee0..bde590d151 100644 --- a/ext/gd/libgd/xbm.c +++ b/ext/gd/libgd/xbm.c @@ -135,7 +135,11 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd) } h[3] = ch; } - sscanf(h, "%x", &b); + if (sscanf(h, "%x", &b) != 1) { + php_gd_error("invalid XBM"); + gdImageDestroy(im); + return 0; + } for (bit = 1; bit <= max_bit; bit = bit << 1) { gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0); if (x == im->sx) { diff --git a/ext/gd/tests/bug77973.phpt b/ext/gd/tests/bug77973.phpt new file mode 100644 index 0000000000..2545dbe128 --- /dev/null +++ b/ext/gd/tests/bug77973.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #77973 (Uninitialized read in gdImageCreateFromXbm) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die("skip gd extension not available"); +if (!function_exists('imagecreatefromxbm')) die("skip imagecreatefromxbm not available"); +?> +--FILE-- +<?php +$contents = hex2bin("23646566696e6520776964746820320a23646566696e652068656967687420320a737461746963206368617220626974735b5d203d7b0a7a7a787a7a"); +$filepath = __DIR__ . '/bug77973.xbm'; +file_put_contents($filepath, $contents); +$im = imagecreatefromxbm($filepath); +var_dump($im); +?> +===DONE=== +--EXPECTF-- +Warning: imagecreatefromxbm(): invalid XBM in %s on line %d + +Warning: imagecreatefromxbm(): '%s' is not a valid XBM file in %s on line %d +bool(false) +===DONE=== +--CLEAN-- +<?php +unlink(__DIR__ . '/bug77973.xbm'); +?> |