diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-06 10:18:51 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-28 08:59:50 +0200 |
| commit | 903b1828dcd68f7cf8b9177a3fe6f481bf627ba9 (patch) | |
| tree | fdc69a1f88e42e9e2edbe2096399d70d42ee1d63 | |
| parent | b7dc3d9039335b2bfaa1f4ade5d38aec89f25922 (diff) | |
| download | php-git-903b1828dcd68f7cf8b9177a3fe6f481bf627ba9.tar.gz | |
Fix #77973: Uninitialized read in gdImageCreateFromXbm
We have to ensure that `sscanf()` does indeed read a hex value here,
and bail out otherwise.
(cherry picked from commit ed6dee9a198c904ad5e03113e58a2d2c200f5184)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_xbm.c | 6 | ||||
| -rw-r--r-- | ext/gd/tests/bug77973.phpt | 26 |
3 files changed, 33 insertions, 1 deletions
@@ -16,6 +16,8 @@ PHP NEWS - GD: . Fixed bug #77943 (imageantialias($image, false); does not work). (cmb) + . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). + (CVE-2019-11038) (cmb) - JSON: . Fixed bug #77843 (Use after free with json serializer). (Nikita) diff --git a/ext/gd/libgd/gd_xbm.c b/ext/gd/libgd/gd_xbm.c index 1ed0d48981..58b1b1bf5d 100644 --- a/ext/gd/libgd/gd_xbm.c +++ b/ext/gd/libgd/gd_xbm.c @@ -136,7 +136,11 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd) } h[3] = ch; } - sscanf(h, "%x", &b); + if (sscanf(h, "%x", &b) != 1) { + gd_error("invalid XBM"); + gdImageDestroy(im); + return 0; + } for (bit = 1; bit <= max_bit; bit = bit << 1) { gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0); if (x == im->sx) { diff --git a/ext/gd/tests/bug77973.phpt b/ext/gd/tests/bug77973.phpt new file mode 100644 index 0000000000..2545dbe128 --- /dev/null +++ b/ext/gd/tests/bug77973.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #77973 (Uninitialized read in gdImageCreateFromXbm) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die("skip gd extension not available"); +if (!function_exists('imagecreatefromxbm')) die("skip imagecreatefromxbm not available"); +?> +--FILE-- +<?php +$contents = hex2bin("23646566696e6520776964746820320a23646566696e652068656967687420320a737461746963206368617220626974735b5d203d7b0a7a7a787a7a"); +$filepath = __DIR__ . '/bug77973.xbm'; +file_put_contents($filepath, $contents); +$im = imagecreatefromxbm($filepath); +var_dump($im); +?> +===DONE=== +--EXPECTF-- +Warning: imagecreatefromxbm(): invalid XBM in %s on line %d + +Warning: imagecreatefromxbm(): '%s' is not a valid XBM file in %s on line %d +bool(false) +===DONE=== +--CLEAN-- +<?php +unlink(__DIR__ . '/bug77973.xbm'); +?> |