|
 |
8d87dc |
Backported from 5.5.37 for 5.4.16
|
|
|
8d87dc |
|
|
|
8d87dc |
From 7722455726bec8c53458a32851d2a87982cf0eac Mon Sep 17 00:00:00 2001
|
|
|
8d87dc |
From: Pierre Joye <pajoye@php.net>
|
|
|
8d87dc |
Date: Sat, 18 Jun 2016 20:15:10 +0200
|
|
|
8d87dc |
Subject: [PATCH] Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
|
|
|
8d87dc |
|
|
|
8d87dc |
From 5f107ab8a66f8b36ac0c0b32e0231bf94e083c94 Mon Sep 17 00:00:00 2001
|
|
|
8d87dc |
From: Stanislav Malyshev <stas@php.net>
|
|
|
8d87dc |
Date: Mon, 20 Jun 2016 22:54:55 -0700
|
|
|
8d87dc |
Subject: [PATCH] fix tests
|
|
|
8d87dc |
|
|
|
8d87dc |
From 0c7250f260303061425d0d8a348d1a80fa0cc12e Mon Sep 17 00:00:00 2001
|
|
|
8d87dc |
From: Anatol Belski <ab@php.net>
|
|
|
8d87dc |
Date: Tue, 21 Jun 2016 09:42:38 +0200
|
|
|
8d87dc |
Subject: [PATCH] remove the huge test file, generate it on the fly instead
|
|
|
8d87dc |
|
|
|
8d87dc |
|
|
|
8d87dc |
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
|
|
|
8d87dc |
index 6726fee..63e3aef 100644
|
|
|
8d87dc |
--- php-5.4.16/ext/gd/libgd/gd_gd2.c.cve5766 2016-08-01 14:11:08.481345064 +0200
|
|
|
8d87dc |
+++ php-5.4.16/ext/gd/libgd/gd_gd2.c 2016-08-01 14:15:39.679591854 +0200
|
|
|
8d87dc |
@@ -138,11 +138,18 @@ static int _gd2GetHeader(gdIOCtxPtr in,
|
|
|
8d87dc |
if (gd2_compressed(*fmt)) {
|
|
|
8d87dc |
nc = (*ncx) * (*ncy);
|
|
|
8d87dc |
GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
|
|
|
8d87dc |
+ if (overflow2(sizeof(t_chunk_info), nc)) {
|
|
|
8d87dc |
+ goto fail1;
|
|
|
8d87dc |
+ }
|
|
|
8d87dc |
sidx = sizeof(t_chunk_info) * nc;
|
|
|
8d87dc |
if (sidx <= 0) {
|
|
|
8d87dc |
goto fail1;
|
|
|
8d87dc |
}
|
|
|
8d87dc |
cidx = gdCalloc(sidx, 1);
|
|
|
8d87dc |
+ if (cidx == NULL) {
|
|
|
8d87dc |
+ goto fail1;
|
|
|
8d87dc |
+ }
|
|
|
8d87dc |
+
|
|
|
8d87dc |
for (i = 0; i < nc; i++) {
|
|
|
8d87dc |
if (gdGetInt(&cidx[i].offset, in) != 1) {
|
|
|
8d87dc |
goto fail1;
|
|
|
8d87dc |
diff --git a/ext/gd/tests/bug72339.phpt b/ext/gd/tests/bug72339.phpt
|
|
|
8d87dc |
new file mode 100644
|
|
|
8d87dc |
index 0000000..763ae71
|
|
|
8d87dc |
--- /dev/null
|
|
|
8d87dc |
+++ b/ext/gd/tests/bug72339.phpt
|
|
|
8d87dc |
@@ -0,0 +1,11 @@
|
|
|
8d87dc |
+--TEST--
|
|
|
8d87dc |
+Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
|
|
|
8d87dc |
+--SKIPIF--
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+--FILE--
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+--EXPECTF--
|
|
|
8d87dc |
+Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
|
|
|
8d87dc |
+ in %sbug72339.php on line %d
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+Warning: imagecreatefromgd2(): '%sbug72339.gd' is not a valid GD2 file in %sbug72339.php on line %d
|
|
|
8d87dc |
|
|
|
8d87dc |
diff --git a/ext/gd/tests/bug72339.phpt b/ext/gd/tests/bug72339.phpt
|
|
|
8d87dc |
index 763ae71..2c30ee8 100644
|
|
|
8d87dc |
--- a/ext/gd/tests/bug72339.phpt
|
|
|
8d87dc |
+++ b/ext/gd/tests/bug72339.phpt
|
|
|
8d87dc |
@@ -3,7 +3,29 @@ Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
|
|
|
8d87dc |
--SKIPIF--
|
|
|
8d87dc |
|
|
|
8d87dc |
--FILE--
|
|
|
8d87dc |
-
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+$fname = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd";
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+$fh = fopen($fname, "w");
|
|
|
8d87dc |
+fwrite($fh, "gd2\x00");
|
|
|
8d87dc |
+fwrite($fh, pack("n", 2));
|
|
|
8d87dc |
+fwrite($fh, pack("n", 1));
|
|
|
8d87dc |
+fwrite($fh, pack("n", 1));
|
|
|
8d87dc |
+fwrite($fh, pack("n", 0x40));
|
|
|
8d87dc |
+fwrite($fh, pack("n", 2));
|
|
|
8d87dc |
+fwrite($fh, pack("n", 0x5AA0)); // Chunks Wide
|
|
|
8d87dc |
+fwrite($fh, pack("n", 0x5B00)); // Chunks Vertically
|
|
|
8d87dc |
+fwrite($fh, str_repeat("\x41\x41\x41\x41", 0x1000000)); // overflow data
|
|
|
8d87dc |
+fclose($fh);
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+$im = imagecreatefromgd2($fname);
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+if ($im) {
|
|
|
8d87dc |
+ imagedestroy($im);
|
|
|
8d87dc |
+}
|
|
|
8d87dc |
+unlink($fname);
|
|
|
8d87dc |
+
|
|
|
8d87dc |
+?>
|
|
|
8d87dc |
--EXPECTF--
|
|
|
8d87dc |
Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
|
|
|
8d87dc |
in %sbug72339.php on line %d
|