mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE

Browse Source 
Also fix for bug #77659
This commit is contained in:
Stanislav Malyshev 2019-03-02 15:07:40 -08:00
parent 5f0e62a3e5
commit 8ac6fee856
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ext/exif/exif.c
View File

@ -2741,7 +2741,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
break;
}
if (maker_note->offset >= value_len) {
if (value_len < 2 || maker_note->offset >= value_len - 1) {
/* Do not go past the value end */
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
return FALSE;
@ -2794,6 +2794,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
break;
default:
case MN_OFFSET_NORMAL:
data_len = value_len;
break;
}

BIN
ext/exif/tests/bug77563.jpg Normal file
View File

Binary file not shown.

16
ext/exif/tests/bug77563.phpt Normal file
View File

@ -0,0 +1,16 @@
--TEST--
Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
$s = exif_thumbnail(__DIR__."/bug77563.jpg");
?>
DONE
--EXPECTF--
Warning: exif_thumbnail(bug77563.jpg): Illegal IFD offset in %s/bug77563.php on line %d
Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s/bug77563.php on line %d
Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s/bug77563.php on line %d
DONE