mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 02:15:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix #79877: getimagesize function silently truncates after a null byte

Browse Source 
We have to check for NUL bytes if `getimagesize()` has been called.
This commit is contained in:
Christoph M. Becker 2020-07-21 11:07:43 +02:00 committed by Stanislav Malyshev
parent 775385df0e
commit 05c5c93705
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ext/standard/image.c
View File

@ -1475,6 +1475,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
Z_PARAM_ZVAL(info)
ZEND_PARSE_PARAMETERS_END();
if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
php_error_docref(NULL, E_WARNING, "Invalid path");
return;
}
if (argc == 2) {
info = zend_try_array_init(info);
if (!info) {

9
ext/standard/tests/image/bug79877.phpt Normal file
View File

@ -0,0 +1,9 @@
--TEST--
Bug #79877 (getimagesize function silently truncates after a null byte)
--FILE--
<?php
var_dump(getimagesize("/tmp/a.png\0xx"));
?>
--EXPECTF--
Warning: getimagesize(): Invalid path in %s on line %d
NULL