diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2017-11-29 18:52:33 +0100 |
|---|---|---|
| committer | Sara Golemon <pollita@php.net> | 2018-01-02 20:45:31 -0500 |
| commit | f03943129b18fac7bbb0801eef8298e13cfce106 (patch) | |
| tree | 355fc57f6a212752e7d28c658eba2a30c8605db5 | |
| parent | b44a1556aa861863ddc721de56f12642579adfd0 (diff) | |
| download | php-git-f03943129b18fac7bbb0801eef8298e13cfce106.tar.gz | |
Fixed bug #75571: Potential infinite loop in gdImageCreateFromGifCtx
Due to a signedness confusion in `GetCode_` a corrupt GIF file can
trigger an infinite loop. Furthermore we make sure that a GIF without
any palette entries is treated as invalid *after* open palette entries
have been removed.
(cherry picked from commit 8d6e9588671136837533fe3785657c31c5b52767)
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_gif_in.c | 10 | ||||
| -rw-r--r-- | ext/gd/tests/bug75571.gif | bin | 0 -> 1731 bytes | |||
| -rw-r--r-- | ext/gd/tests/bug75571.phpt | 15 |
4 files changed, 24 insertions, 5 deletions
@@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.1.13 +- GD: + . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). + (Christoph) + - Opcache: . Fixed bug #75579 (Interned strings buffer overflow may cause crash). (Dmitry) diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c index 76ba152035..7156e4b8e0 100644 --- a/ext/gd/libgd/gd_gif_in.c +++ b/ext/gd/libgd/gd_gif_in.c @@ -261,10 +261,6 @@ terminated: if (!im) { return 0; } - if (!im->colorsTotal) { - gdImageDestroy(im); - return 0; - } /* Check for open colors at the end, so we can reduce colorsTotal and ultimately BitsPerPixel */ @@ -275,6 +271,10 @@ terminated: break; } } + if (!im->colorsTotal) { + gdImageDestroy(im); + return 0; + } return im; } /* }}} */ @@ -375,7 +375,7 @@ static int GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP) { int i, j, ret; - unsigned char count; + int count; if (flag) { scd->curbit = 0; diff --git a/ext/gd/tests/bug75571.gif b/ext/gd/tests/bug75571.gif Binary files differnew file mode 100644 index 0000000000..3c30b40f28 --- /dev/null +++ b/ext/gd/tests/bug75571.gif diff --git a/ext/gd/tests/bug75571.phpt b/ext/gd/tests/bug75571.phpt new file mode 100644 index 0000000000..5bd26b84ec --- /dev/null +++ b/ext/gd/tests/bug75571.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #75571 (Infinite loop in GIF reading causing DoS) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif')); +?> +===DONE=== +--EXPECTF-- +Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d +bool(false) +===DONE=== |
