#43790 [NEW]: DoS (segfault) in libgd TTF processing

From: wccoder at gmail dot com Operating system: Fedora Core 7, x64 PHP version: 5.2.5 PHP Bug Type: GD related Bug description: DoS (segfault) in libgd TTF processing Description: ------------ ext/gd/libgd/gdft.c:950 if (font->face->charmap->encoding == FT_ENCODING_MS_SYMBOL && strcmp(font->face->family_name, "Symbol") == 0) { A crafted .ttf file with a null font->face->family_name causes strcmp to attempt to access memory out of bounds and cores. I have a sample .ttf file I can send. Reproduce code: --------------- <?php $size = imagettfbbox(10, 0, 'crafted_font.ttf', 'steve'); ?> Expected result: ---------------- The php process cores. Actual result: -------------- #0 0x000000356c876bd0 in strcmp () from /lib64/libc.so.6 #1 0x00000000004bc5b3 in php_gd_gdImageStringFTEx (im=0x0, brect=0x7fffbce07cc0, fg=-1, fontlist=0xba5b80 "shifter_3042_4.ttf", ptsize=10, angle=0, x=-1, y=-1, string=0xba8fb8 "steve", strex=0x0) at /home/wccoder/build/php-5.2.5/ext/gd/libgd/gdft.c:953 #2 0x00000000004bbe2b in php_gd_gdImageStringFT (im=0x0, brect=0x7fffbce07cc0, fg=-1, fontlist=0xba5b80 "shifter_3042_4.ttf", ptsize=10, angle=0, x=-1, y=-1, string=0xba8fb8 "steve") at /home/wccoder/build/php-5.2.5/ext/gd/libgd/gdft.c:769 #3 0x00000000004a3d44 in php_imagettftext_common (ht=<value optimized out>, return_value=0xba73f8, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>, mode=<value optimized out>, extended=0) at /home/wccoder/build/php-5.2.5/ext/gd/gd.c:4303 #4 0x00000000004a3de6 in zif_imagettfbbox (ht=0, return_value=0x740fa0, return_value_ptr=0x7fffbce077d0, this_ptr=0x356cb4b760, return_value_used=-1) at /home/wccoder/build/php-5.2.5/ext/gd/gd.c:4199 #5 0x0000000000665f1b in zend_do_fcall_common_helper_SPEC (execute_data=0x7fffbce07f40) at /home/wccoder/build/php-5.2.5/Zend/zend_vm_execute.h:200 #6 0x0000000000665013 in execute (op_array=0xba6d58) at /home/wccoder/build/php-5.2.5/Zend/zend_vm_execute.h:92 #7 0x0000000000647013 in zend_execute_scripts (type=8, retval=0xbd8f80, file_count=3) at /home/wccoder/build/php-5.2.5/Zend/zend.c:1134 #8 0x000000000060776b in php_execute_script (primary_file=0x7fffbce0a5b0) at /home/wccoder/build/php-5.2.5/main/main.c:2004 #9 0x00000000006c1e42 in main (argc=3, argv=0x7fffbce0a7b8) at /home/wccoder/build/php-5.2.5/sapi/cli/php_cli.c:1140 -- Edit bug report at http://bugs.php.net/?id=43790&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=43790&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=43790&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=43790&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=43790&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=43790&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=43790&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=43790&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=43790&r=needscript Try newer version: http://bugs.php.net/fix.php?id=43790&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=43790&r=support Expected behavior: http://bugs.php.net/fix.php?id=43790&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=43790&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=43790&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=43790&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=43790&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=43790&r=dst IIS Stability: http://bugs.php.net/fix.php?id=43790&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=43790&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=43790&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=43790&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=43790&r=mysqlcfg