mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix #74435: Buffer over-read into uninitialized memory

Browse Source 
The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.
This commit is contained in:
Christoph M. Becker 2017-06-20 16:45:42 +02:00 committed by Stanislav Malyshev
parent 5f8380d33e
commit 8dc4f4dc9e
3 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ext/gd/libgd/gd_gif_in.c
View File

@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
int haveGlobalColormap;
gdImagePtr im = 0;
memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
/*1.4//imageNumber = 1; */
if (! ReadOK(fd,buf,6)) {
return 0;

BIN
ext/gd/tests/bug74435.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

27
ext/gd/tests/bug74435.phpt Normal file
View File

@ -0,0 +1,27 @@
--TEST--
Bug #74435 (Buffer over-read into uninitialized memory)
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
?>
--FILE--
<?php
$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
var_dump($im);
$width = imagesx($im);
$height = imagesy($im);
for ($i = 0; $i < $width; $i += 16) {
for ($j = 0; $j < $height; $j += 16) {
if (($index = imagecolorat($im, $i, $j)) >= 2) {
list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
echo "unexpected color at ($i, $j)\n";
}
}
}
}
?>
===DONE===
--EXPECTF--
resource(%d) of type (gd)
===DONE===