1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
commit 3a9f03aed8efa69e13b6aa4abb1ce2d5f1a7e12c
Author: Stanislav Malyshev <stas@php.net>
Date: Sun Sep 28 16:57:42 2014 -0700
Fix bug #68113 (Heap corruption in exif_thumbnail())
Index: php5-5.3.3/ext/exif/exif.c
===================================================================
--- php5-5.3.3.orig/ext/exif/exif.c 2014-11-23 15:35:52.000000000 +0100
+++ php5-5.3.3/ext/exif/exif.c 2014-11-23 15:35:52.000000000 +0100
@@ -2440,11 +2440,11 @@
data_ptr += 8;
break;
case TAG_FMT_SINGLE:
- memmove(data_ptr, &info_data->value.f, byte_count);
+ memmove(data_ptr, &info_value->f, 4);
data_ptr += 4;
break;
case TAG_FMT_DOUBLE:
- memmove(data_ptr, &info_data->value.d, byte_count);
+ memmove(data_ptr, &info_value->d, 8);
data_ptr += 8;
break;
}
Index: php5-5.3.3/ext/exif/tests/bug68113.phpt
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ php5-5.3.3/ext/exif/tests/bug68113.phpt 2014-11-23 15:35:52.000000000 +0100
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
\ No newline at end of file
|
