#44388 [NEW]: exif_read_data() causes segfault on a certain image

From: jon at tgpsolutions dot com Operating system: Linux PHP version: 5.2.5 PHP Bug Type: Reproducible crash Bug description: exif_read_data() causes segfault on a certain image Description: ------------ PHP segfaults trying to read the EXIF data for this image: http://jon.tgpsolutions.com/exif_read_data-bug.jpg I hit this bug initially on PHP 5.2.1 (the version in Ubuntu 7.04), was able to reproduce on PHP 5.2.3-1ubuntu6.3 (the version in Ubuntu 7.10), and was able to reproduce again on PHP 5.2.5 compiled from source. #43630 looks similar to this bug, but it was closed as Bogus with the explaination "This simply tells you that your EXIF information is broken" - maybe the submitter wasn't clear that PHP segfaults after displaying the warnings? The sample image isn't available anymore, so I can't be sure if PHP segfaults or not in their case. Reproduce code: --------------- test.php: <?php $exif = exif_read_data('exif_read_data-bug.jpg'); ?> Expected result: ---------------- $exif contains EXIF data for the image. Actual result: -------------- jon@interceptor:~$ php test.php PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xA92D=UndefinedTa): Illegal format code 0x4320, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xA92D=UndefinedTa): Illegal pointer offset(x74686769 + x7279706F = xE6E1D7D8 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x3220=UndefinedTa): Illegal format code 0x3030, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x3220=UndefinedTa): Illegal pointer offset(x43206565 < x406D2B12) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x6168=UndefinedTa): Illegal format code 0x206E, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x6168=UndefinedTa): Illegal pointer offset(x72694672 < x406D2B1E) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x2065=UndefinedTa): Illegal format code 0x6D49, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x2065=UndefinedTa): Illegal pointer offset(xE1FF2967 + x6E696761 = x506890C8 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xF15F=UndefinedTa): Illegal format code 0x7845, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(xF15F=UndefinedTa): Illegal pointer offset(x2A4949 + x6669 = x2AAFB2 > x5FE9) in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x4C69=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 ... above line repeated many more times... PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 PHP Warning: exif_read_data(exif_read_data-bug.jpg): Process tag(x0000=UndefinedTa): Illegal format code 0x0000, suppose BYTE in /home/jon/test.php on line 1 Segmentation fault jon@interceptor:~$ -- Edit bug report at http://bugs.php.net/?id=44388&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=44388&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=44388&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=44388&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=44388&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=44388&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=44388&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=44388&r=needscript Try newer version: http://bugs.php.net/fix.php?id=44388&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=44388&r=support Expected behavior: http://bugs.php.net/fix.php?id=44388&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=44388&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=44388&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=44388&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=44388&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=44388&r=dst IIS Stability: http://bugs.php.net/fix.php?id=44388&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=44388&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=44388&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=44388&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=44388&r=mysqlcfg