|
 |
ba24df |
Fix for CVE-2017-10168
|
|
|
ba24df |
Backported for 5.4 without test and binary patch
|
|
|
ba24df |
|
|
|
ba24df |
|
|
|
ba24df |
From d2274b01cbbadf5516b3ea87ad76fbae18834007 Mon Sep 17 00:00:00 2001
|
|
|
ba24df |
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
|
|
ba24df |
Date: Sat, 17 Dec 2016 17:06:58 +0100
|
|
|
ba24df |
Subject: [PATCH] Fix #73869: Signed Integer Overflow gd_io.c
|
|
|
ba24df |
|
|
|
ba24df |
GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
|
|
|
ba24df |
byte unsigned). These values are multiplied and assigned to an int when
|
|
|
ba24df |
reading the image, what can cause integer overflows. We have to avoid
|
|
|
ba24df |
that, and also make sure that either chunk count is actually greater
|
|
|
ba24df |
than zero. If illegal chunk counts are detected, we bail out from
|
|
|
ba24df |
reading the image.
|
|
|
ba24df |
|
|
|
ba24df |
(cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1)
|
|
|
ba24df |
---
|
|
|
ba24df |
ext/gd/libgd/gd_gd2.c | 4 ++++
|
|
|
ba24df |
ext/gd/tests/bug73869.phpt | 19 +++++++++++++++++++
|
|
|
ba24df |
ext/gd/tests/bug73869a.gd2 | Bin 0 -> 92 bytes
|
|
|
ba24df |
ext/gd/tests/bug73869b.gd2 | Bin 0 -> 18 bytes
|
|
|
ba24df |
4 files changed, 23 insertions(+)
|
|
|
ba24df |
create mode 100644 ext/gd/tests/bug73869.phpt
|
|
|
ba24df |
create mode 100644 ext/gd/tests/bug73869a.gd2
|
|
|
ba24df |
create mode 100644 ext/gd/tests/bug73869b.gd2
|
|
|
ba24df |
|
|
|
ba24df |
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
index 196b785..3eba6b3 100644
|
|
|
ba24df |
--- a/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
+++ b/ext/gd/libgd/gd_gd2.c
|
|
|
ba24df |
@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
|
|
|
ba24df |
GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));
|
|
|
ba24df |
|
|
|
ba24df |
if (gd2_compressed(*fmt)) {
|
|
|
ba24df |
+ if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
|
|
|
ba24df |
+ GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
|
|
|
ba24df |
+ goto fail1;
|
|
|
ba24df |
+ }
|
|
|
ba24df |
nc = (*ncx) * (*ncy);
|
|
|
ba24df |
GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
|
|
|
ba24df |
if (overflow2(sizeof(t_chunk_info), nc)) {
|
|
|
ba24df |
--
|
|
|
ba24df |
2.1.4
|
|
|
ba24df |
|