#41630 [NEW]: Non-exploitable (DoS) heap corruption with GIF

From: wccoder at gmail dot com Operating system: Linux PHP version: 5.2.3 PHP Bug Type: GD related Bug description: Non-exploitable (DoS) heap corruption with GIF Description: ------------ The corruption actually happens at ext/gd/libgd/gd_gif_in.c:590-594 590 while ((v = LWZReadByte(fd, &sd, FALSE, c, ZeroDataBlockP)) >= 0 ) { 591 /* This how we recognize which colors are actually used. */ 592 if (im->open[v]) { 593 im->open[v] = 0; 594 } Values read from the data stream are not bounds-checked. An attacker can create values of v (type int) which are larger than the array im->open (256 bytes). If the value of im->open[v] happens to be non-zero, it is overwritten with a zero on line 593. This corrupts the heap. The attacker can't control what value is overwritten (always 0), but they could control which bytes are overwritten. libgd should clamp values of v to be between acceptable values [0,255]. Note that values of v are clamped to 4096, since this is the maximum number of bits per codeword that gd will accept, so it isn't an arbitrary overwrite. It is enough to corrupt the heap and cause a DoS though. Reproduce code: --------------- I have a sample .gif file. Email me for it. -- Edit bug report at http://bugs.php.net/?id=41630&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41630&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41630&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41630&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41630&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41630&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41630&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41630&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41630&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41630&r=support Expected behavior: http://bugs.php.net/fix.php?id=41630&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41630&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41630&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41630&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41630&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41630&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41630&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41630&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41630&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41630&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41630&r=mysqlcfg