|
 |
af9dc8 |
From afbf725e7380dfb3ff43a993e43abd9759a66c2b Mon Sep 17 00:00:00 2001
|
|
|
af9dc8 |
From: Remi Collet <remi@php.net>
|
|
|
af9dc8 |
Date: Sat, 13 Dec 2014 09:03:44 +0100
|
|
|
af9dc8 |
Subject: [PATCH] Fix bug #68601 buffer read overflow in gd_gif_in.c
|
|
|
af9dc8 |
|
|
|
af9dc8 |
---
|
|
|
af9dc8 |
NEWS | 3 +++
|
|
|
af9dc8 |
ext/gd/libgd/gd_gif_in.c | 11 +++++++++--
|
|
|
af9dc8 |
2 files changed, 12 insertions(+), 2 deletions(-)
|
|
|
af9dc8 |
|
|
|
af9dc8 |
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
index ee88a2f..491e942 100644
|
|
|
af9dc8 |
--- a/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
+++ b/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
@@ -72,8 +72,10 @@ static struct {
|
|
|
af9dc8 |
|
|
|
af9dc8 |
#define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
|
|
|
af9dc8 |
|
|
|
af9dc8 |
+#define CSD_BUF_SIZE 280
|
|
|
af9dc8 |
+
|
|
|
af9dc8 |
typedef struct {
|
|
|
af9dc8 |
- unsigned char buf[280];
|
|
|
af9dc8 |
+ unsigned char buf[CSD_BUF_SIZE];
|
|
|
af9dc8 |
int curbit, lastbit, done, last_byte;
|
|
|
af9dc8 |
} CODE_STATIC_DATA;
|
|
|
af9dc8 |
|
|
|
af9dc8 |
@@ -400,7 +402,12 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
|
|
|
af9dc8 |
|
|
|
af9dc8 |
ret = 0;
|
|
|
af9dc8 |
for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
|
|
|
af9dc8 |
- ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
|
|
|
af9dc8 |
+ if (i < CSD_BUF_SIZE * 8) {
|
|
|
af9dc8 |
+ ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
|
|
|
af9dc8 |
+ } else {
|
|
|
af9dc8 |
+ ret = -1;
|
|
|
af9dc8 |
+ break;
|
|
|
af9dc8 |
+ }
|
|
|
af9dc8 |
|
|
|
af9dc8 |
scd->curbit += code_size;
|
|
|
af9dc8 |
return ret;
|
|
|
af9dc8 |
--
|
|
|
af9dc8 |
2.1.4
|
|
|
af9dc8 |
|
|
|
af9dc8 |
From bd31cb756399101234258c5491443531099957c3 Mon Sep 17 00:00:00 2001
|
|
|
af9dc8 |
From: Remi Collet <remi@php.net>
|
|
|
af9dc8 |
Date: Wed, 17 Dec 2014 10:59:36 +0100
|
|
|
af9dc8 |
Subject: [PATCH] Better fix for #68601 for perf
|
|
|
af9dc8 |
https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467
|
|
|
af9dc8 |
|
|
|
af9dc8 |
---
|
|
|
af9dc8 |
ext/gd/libgd/gd_gif_in.c | 12 ++++++------
|
|
|
af9dc8 |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
af9dc8 |
|
|
|
af9dc8 |
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
index 491e942..f41ec84 100644
|
|
|
af9dc8 |
--- a/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
+++ b/ext/gd/libgd/gd_gif_in.c
|
|
|
af9dc8 |
@@ -400,14 +400,14 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
|
|
|
af9dc8 |
scd->lastbit = (2+count)*8 ;
|
|
|
af9dc8 |
}
|
|
|
af9dc8 |
|
|
|
af9dc8 |
- ret = 0;
|
|
|
af9dc8 |
- for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
|
|
|
af9dc8 |
- if (i < CSD_BUF_SIZE * 8) {
|
|
|
af9dc8 |
+ if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) {
|
|
|
af9dc8 |
+ ret = -1;
|
|
|
af9dc8 |
+ } else {
|
|
|
af9dc8 |
+ ret = 0;
|
|
|
af9dc8 |
+ for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
|
|
|
af9dc8 |
ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
|
|
|
af9dc8 |
- } else {
|
|
|
af9dc8 |
- ret = -1;
|
|
|
af9dc8 |
- break;
|
|
|
af9dc8 |
}
|
|
|
af9dc8 |
+ }
|
|
|
af9dc8 |
|
|
|
af9dc8 |
scd->curbit += code_size;
|
|
|
af9dc8 |
return ret;
|
|
|
af9dc8 |
--
|
|
|
af9dc8 |
2.1.4
|
|
|
af9dc8 |
|