Skip to content

Instantly share code, notes, and snippets.

@smalyshev

smalyshev/76423.diff Secret

Created Jun 19, 2018
Embed
What would you like to do?
commit d4553c8c76664a87b193799d3bbce7cadf67f855
Author: Stanislav Malyshev <stas@php.net>
Date: Tue Jun 19 16:26:36 2018 -0700
Fix bug #76423 - Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index e535278fc9..1147980f77 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2545,7 +2545,10 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz
return;
}
/* Check to make sure we are not going to go past the ExifLength */
- if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) {
+ if (ImageInfo->Thumbnail.size > length
+ || (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
+ || ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
+ ) {
EXIF_ERRLOG_THUMBEOF(ImageInfo)
return;
}
diff --git a/ext/exif/tests/bug76423.jpg b/ext/exif/tests/bug76423.jpg
new file mode 100644
index 0000000000..08fe2bbc57
Binary files /dev/null and b/ext/exif/tests/bug76423.jpg differ
diff --git a/ext/exif/tests/bug76423.phpt b/ext/exif/tests/bug76423.phpt
new file mode 100644
index 0000000000..4c8cd45dc9
--- /dev/null
+++ b/ext/exif/tests/bug76423.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #76423 (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76423.jpg', 0, true, true);
+?>
+===DONE===
+--EXPECTF--
+
+Warning: exif_read_data(%s.jpg): Thumbnail goes IFD boundary or end of file reached in %s on line %d
+
+Warning: exif_read_data(%s.jpg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(%s.jpg): Invalid JPEG file in %s on line %d
+===DONE===
@Kachuakay

This comment has been minimized.

Copy link

@Kachuakay Kachuakay commented Jul 25, 2018

Xong

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment