|
 |
ba24df |
Fix for CVE-2017-10168
|
|
|
ba24df |
Backported for 5.4 without test and binary patch
|
|
|
ba24df |
|
|
|
ba24df |
|
|
|
ba24df |
From f1b2afc9d9e77edf41804f5dfc4e2069d8a12975 Mon Sep 17 00:00:00 2001
|
|
|
ba24df |
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
|
|
ba24df |
Date: Tue, 16 Aug 2016 18:23:36 +0200
|
|
|
ba24df |
Subject: [PATCH] Fix #73868: DOS vulnerability in gdImageCreateFromGd2Ctx()
|
|
|
ba24df |
|
|
|
ba24df |
We must not pretend that there are image data if there are none. Instead
|
|
|
ba24df |
we fail reading the image file gracefully.
|
|
|
ba24df |
|
|
|
ba24df |
(cherry picked from commit cdb648dc4115ce0722f3cc75e6a65115fc0e56ab)
|
|
|
ba24df |
---
|
|
|
ba24df |
ext/gd/libgd/gd_gd2.c | 8 ++++++--
|
|
|
ba24df |
ext/gd/tests/bug73868.gd2 | Bin 0 -> 1050 bytes
|
|
|
ba24df |
ext/gd/tests/bug73868.phpt | 18 ++++++++++++++++++
|
|
|
ba24df |
3 files changed, 24 insertions(+), 2 deletions(-)
|
|
|
ba24df |
create mode 100644 ext/gd/tests/bug73868.gd2
|
|
|
ba24df |
create mode 100644 ext/gd/tests/bug73868.phpt
|
|
|
ba24df |
|
|
|
ba24df |
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
index d06f328..196b785 100644
|
|
|
ba24df |
--- a/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
+++ b/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
@@ -334,12 +334,16 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
|
|
|
ba24df |
for (x = xlo; x < xhi; x++) {
|
|
|
ba24df |
if (im->trueColor) {
|
|
|
ba24df |
if (!gdGetInt(&im->tpixels[y][x], in)) {
|
|
|
ba24df |
- im->tpixels[y][x] = 0;
|
|
|
ba24df |
+ php_gd_error("gd2: EOF while reading\n");
|
|
|
ba24df |
+ gdImageDestroy(im);
|
|
|
ba24df |
+ return NULL;
|
|
|
ba24df |
}
|
|
|
ba24df |
} else {
|
|
|
ba24df |
int ch;
|
|
|
ba24df |
if (!gdGetByte(&ch, in)) {
|
|
|
ba24df |
- ch = 0;
|
|
|
ba24df |
+ php_gd_error("gd2: EOF while reading\n");
|
|
|
ba24df |
+ gdImageDestroy(im);
|
|
|
ba24df |
+ return NULL;
|
|
|
ba24df |
}
|
|
|
ba24df |
im->pixels[y][x] = ch;
|
|
|
ba24df |
}
|
|
|
ba24df |
--
|
|
|
ba24df |
2.1.4
|
|
|
ba24df |
|