diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-12-16 00:10:39 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-12-16 00:10:39 -0800 |
| commit | d348cfb96f2543565691010ade5e0346338be5a7 (patch) | |
| tree | 0c66dc65e4f4c3ff023f5c0e91159a13bfeb4b7b /ext/exif | |
| parent | eb23c6008753b1cdc5359dead3a096dce46c9018 (diff) | |
| download | php-git-d348cfb96f2543565691010ade5e0346338be5a7.tar.gz | |
Fixed bug #78910
Diffstat (limited to 'ext/exif')
| -rw-r--r-- | ext/exif/exif.c | 3 | ||||
| -rw-r--r-- | ext/exif/tests/bug78910.phpt | 17 |
2 files changed, 19 insertions, 1 deletions
diff --git a/ext/exif/exif.c b/ext/exif/exif.c index f961f44a46..c0be05922f 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3165,7 +3165,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu continue; if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model))) continue; - if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len)) + if (maker_note->id_string && value_len >= maker_note->id_string_len + && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len)) continue; break; } diff --git a/ext/exif/tests/bug78910.phpt b/ext/exif/tests/bug78910.phpt new file mode 100644 index 0000000000..f5b1c32c1b --- /dev/null +++ b/ext/exif/tests/bug78910.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044) +--FILE-- +<?php + +var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN')); + +?> +--EXPECTF-- +Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote ): Illegal format code 0x2020, switching to BYTE in %s on line %d + +Warning: exif_read_data(): Process tag(x927C=MakerNote ): Illegal format code 0x2020, suppose BYTE in %s on line %d + +Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d + +Warning: exif_read_data(): Invalid TIFF file in %s on line %d +bool(false) |