diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-05-27 17:16:29 -0700 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2019-05-28 08:55:19 +0200 |
| commit | b7dc3d9039335b2bfaa1f4ade5d38aec89f25922 (patch) | |
| tree | edc8ded0ec5aea94a4329b9f7a1af86ee9c28e13 | |
| parent | 53c1b485741f31a17b24f4db2b39afeb9f4c8aba (diff) | |
| download | php-git-b7dc3d9039335b2bfaa1f4ade5d38aec89f25922.tar.gz | |
Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
(cherry picked from commit 73ff4193be24192c894dc0502d06e2b2db35eefb)
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/exif/exif.c | 2 | ||||
| -rw-r--r-- | ext/exif/tests/bug77988.jpg | bin | 0 -> 1202 bytes | |||
| -rw-r--r-- | ext/exif/tests/bug77988.phpt | 11 |
4 files changed, 17 insertions, 0 deletions
@@ -6,6 +6,10 @@ PHP NEWS . Implemented FR #72189 (Add missing CURL_VERSION_* constants). (Javier Spagnoletti) +- EXIF: + . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). + (CVE-2019-11040) (Stas) + - FPM: . Fixed bug #77934 (php-fpm kill -USR2 not working). (Jakub Zelenka) . Fixed bug #77921 (static.php.net doesn't work anymore). (Peter Kokot) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 78269b9a92..e04290376c 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3920,6 +3920,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo) if (c == 0xFF) return FALSE; marker = c; + if (pos>=ImageInfo->Thumbnail.size) + return FALSE; length = php_jpg_get16(data+pos); if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) { return FALSE; diff --git a/ext/exif/tests/bug77988.jpg b/ext/exif/tests/bug77988.jpg Binary files differnew file mode 100644 index 0000000000..120ff8565a --- /dev/null +++ b/ext/exif/tests/bug77988.jpg diff --git a/ext/exif/tests/bug77988.phpt b/ext/exif/tests/bug77988.phpt new file mode 100644 index 0000000000..1632c8afaa --- /dev/null +++ b/ext/exif/tests/bug77988.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #77988 (heap-buffer-overflow on php_jpg_get16) +--SKIPIF-- +<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?> +--FILE-- +<?php +exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE); +?> +DONE +--EXPECTF-- +DONE
\ No newline at end of file |
