|
 |
20017b |
From afbf725e7380dfb3ff43a993e43abd9759a66c2b Mon Sep 17 00:00:00 2001
|
|
|
20017b |
From: Remi Collet <remi@php.net>
|
|
|
20017b |
Date: Sat, 13 Dec 2014 09:03:44 +0100
|
|
|
20017b |
Subject: [PATCH] Fix bug #68601 buffer read overflow in gd_gif_in.c
|
|
|
20017b |
|
|
|
20017b |
---
|
|
|
20017b |
NEWS | 3 +++
|
|
|
20017b |
ext/gd/libgd/gd_gif_in.c | 11 +++++++++--
|
|
|
20017b |
2 files changed, 12 insertions(+), 2 deletions(-)
|
|
|
20017b |
|
|
|
20017b |
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
index ee88a2f..491e942 100644
|
|
|
20017b |
--- a/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
+++ b/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
@@ -72,8 +72,10 @@ static struct {
|
|
|
20017b |
|
|
|
20017b |
#define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
|
|
|
20017b |
|
|
|
20017b |
+#define CSD_BUF_SIZE 280
|
|
|
20017b |
+
|
|
|
20017b |
typedef struct {
|
|
|
20017b |
- unsigned char buf[280];
|
|
|
20017b |
+ unsigned char buf[CSD_BUF_SIZE];
|
|
|
20017b |
int curbit, lastbit, done, last_byte;
|
|
|
20017b |
} CODE_STATIC_DATA;
|
|
|
20017b |
|
|
|
20017b |
@@ -400,7 +402,12 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
|
|
|
20017b |
|
|
|
20017b |
ret = 0;
|
|
|
20017b |
for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
|
|
|
20017b |
- ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
|
|
|
20017b |
+ if (i < CSD_BUF_SIZE * 8) {
|
|
|
20017b |
+ ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
|
|
|
20017b |
+ } else {
|
|
|
20017b |
+ ret = -1;
|
|
|
20017b |
+ break;
|
|
|
20017b |
+ }
|
|
|
20017b |
|
|
|
20017b |
scd->curbit += code_size;
|
|
|
20017b |
return ret;
|
|
|
20017b |
--
|
|
|
20017b |
2.1.4
|
|
|
20017b |
|
|
|
20017b |
From bd31cb756399101234258c5491443531099957c3 Mon Sep 17 00:00:00 2001
|
|
|
20017b |
From: Remi Collet <remi@php.net>
|
|
|
20017b |
Date: Wed, 17 Dec 2014 10:59:36 +0100
|
|
|
20017b |
Subject: [PATCH] Better fix for #68601 for perf
|
|
|
20017b |
https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467
|
|
|
20017b |
|
|
|
20017b |
---
|
|
|
20017b |
ext/gd/libgd/gd_gif_in.c | 12 ++++++------
|
|
|
20017b |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
20017b |
|
|
|
20017b |
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
index 491e942..f41ec84 100644
|
|
|
20017b |
--- a/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
+++ b/ext/gd/libgd/gd_gif_in.c
|
|
|
20017b |
@@ -400,14 +400,14 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
|
|
|
20017b |
scd->lastbit = (2+count)*8 ;
|
|
|
20017b |
}
|
|
|
20017b |
|
|
|
20017b |
- ret = 0;
|
|
|
20017b |
- for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
|
|
|
20017b |
- if (i < CSD_BUF_SIZE * 8) {
|
|
|
20017b |
+ if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) {
|
|
|
20017b |
+ ret = -1;
|
|
|
20017b |
+ } else {
|
|
|
20017b |
+ ret = 0;
|
|
|
20017b |
+ for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
|
|
|
20017b |
ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
|
|
|
20017b |
- } else {
|
|
|
20017b |
- ret = -1;
|
|
|
20017b |
- break;
|
|
|
20017b |
}
|
|
|
20017b |
+ }
|
|
|
20017b |
|
|
|
20017b |
scd->curbit += code_size;
|
|
|
20017b |
return ret;
|
|
|
20017b |
--
|
|
|
20017b |
2.1.4
|
|
|
20017b |
|