mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-01-23 20:23:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix #73280: Stack Buffer Overflow in GD dynamicGetbuf

Browse Source 
We make sure to never pass a negative `rlen` as size to memcpy().

Cf. <https://github.com/libgd/libgd/commit/53110871>.
This commit is contained in:
Christoph M. Becker 2016-10-13 11:10:02 +02:00
parent 43ccf23d70
commit cc08cbc84d
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -7,6 +7,7 @@ PHP NEWS
. Fixed bug #73272 (imagescale() is not affected by, but affects
imagesetinterpolation()). (cmb)
. Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
. Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
- SOAP:
. Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)

2
ext/gd/libgd/gd_io_dp.c
View File

@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
if (remain >= len) {
rlen = len;
} else {
if (remain == 0) {
if (remain <= 0) {
return EOF;
}
rlen = remain;