From b4e4788c4461449b4587e19ef1f474ce938e4980 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 27 Mar 2018 18:42:55 +0200 Subject: Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value The MakerNote is not necessarily null-terminated, so we must not use `strlen()` to avoid OOB reads. Instead `php_strnlen()` is the proper way to handle this. --- ext/exif/exif.c | 2 +- ext/exif/tests/bug76130.phpt | 20 ++++++++++++++++++++ ext/exif/tests/bug76130_1.jpg | Bin 0 -> 3396 bytes ext/exif/tests/bug76130_2.jpg | Bin 0 -> 1632 bytes 4 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 ext/exif/tests/bug76130.phpt create mode 100644 ext/exif/tests/bug76130_1.jpg create mode 100644 ext/exif/tests/bug76130_2.jpg diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 1c8772f76b..e535278fc9 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c case TAG_FMT_UNDEFINED: if (value) { if (tag == TAG_MAKER_NOTE) { - length = MIN(length, strlen(value)); + length = (int) php_strnlen(value, length); } /* do not recompute length here */ diff --git a/ext/exif/tests/bug76130.phpt b/ext/exif/tests/bug76130.phpt new file mode 100644 index 0000000000..9c826af629 --- /dev/null +++ b/ext/exif/tests/bug76130.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value) +--DESCRIPTION-- +This test is meant to exhibit memory issues with the `-m` option. Since a lot of +notices and warnings are to be expected anyway, we suppress these, since the are +not relevant for this test. +--INI-- +error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +===DONE=== diff --git a/ext/exif/tests/bug76130_1.jpg b/ext/exif/tests/bug76130_1.jpg new file mode 100644 index 0000000000..e063e46d22 Binary files /dev/null and b/ext/exif/tests/bug76130_1.jpg differ diff --git a/ext/exif/tests/bug76130_2.jpg b/ext/exif/tests/bug76130_2.jpg new file mode 100644 index 0000000000..a9e79dca5c Binary files /dev/null and b/ext/exif/tests/bug76130_2.jpg differ -- cgit v1.2.1