Skip to content

Instantly share code, notes, and snippets.

@smalyshev smalyshev/77563.diff Secret
Created Mar 2, 2019

Embed
What would you like to do?
commit 6c4d81b524cf664748dd89579aa9157a5955f8b0
Author: Stanislav Malyshev <stas@php.net>
Date: Sat Mar 2 15:07:40 2019 -0800
Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
Also fix for bug #77659
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index cbde3effed..b90f62f09d 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2741,7 +2741,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
break;
}
- if (maker_note->offset >= value_len) {
+ if (value_len < 2 || maker_note->offset >= value_len - 1) {
/* Do not go past the value end */
exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
return FALSE;
@@ -2794,6 +2794,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
break;
default:
case MN_OFFSET_NORMAL:
+ data_len = value_len;
break;
}
diff --git a/ext/exif/tests/bug77563.jpg b/ext/exif/tests/bug77563.jpg
new file mode 100644
index 0000000000..d6280151f0
Binary files /dev/null and b/ext/exif/tests/bug77563.jpg differ
diff --git a/ext/exif/tests/bug77563.phpt b/ext/exif/tests/bug77563.phpt
new file mode 100644
index 0000000000..c14588664b
--- /dev/null
+++ b/ext/exif/tests/bug77563.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$s = exif_thumbnail(__DIR__."/bug77563.jpg");
+?>
+DONE
+--EXPECTF--
+Warning: exif_thumbnail(bug77563.jpg): Illegal IFD offset in %s/bug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s/bug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s/bug77563.php on line %d
+DONE
\ No newline at end of file
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.