Bug #18052: getimagesize() should not trust the header info in gifs

From: arpen@home.se Operating system: Linux PHP version: 4.2.1 PHP Bug Type: GetImageSize related Bug description: getimagesize() should not trust the header info in gifs getimagesize() blindly trusts the width and height specified in the header of gifs. You can just hexedit the file and set the width and height to any value and getimagesize() will believe that is the "true size" of the image. Even worse - Internet Explorer ignores the width and height in the header and thus it is possible to, for instance, upload a much larger image in an upload form that uses getimagesize() than what is allowed. I believe getimagesize() should just skip the header and read the size from the beginning of the "Image Block". http://www.goice.co.jp/member/mo/formats/gif.html -- Edit bug report at http://bugs.php.net/?id=18052&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=18052&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18052&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18052&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18052&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18052&r=support Expected behavior: http://bugs.php.net/fix.php?id=18052&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18052&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18052&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18052&r=globals