Bug #62523 [Fbk->ReO]: php crashes with segfault when exif_read_data called

Edit report at https://bugs.php.net/bug.php?id=62523&edit=1 ID: 62523 Updated by: laruence@php.net Reported by: bigbug at mafia dot lv Summary: php crashes with segfault when exif_read_data called -Status: Feedback +Status: Re-Opened Type: Bug Package: Reproducible crash Operating System: linux PHP Version: 5.3Git-2012-07-10 (snap) Block user comment: N Private report: N New Comment: I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095 return (((uchar *)value)[1] << 8) | ((uchar *)value)[0]; (gdb) bt #0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 #1 0x00002b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15, format=3, length=12, value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762 #2 0x00002b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15, format=3, length=12, value=0xffffffffcc675e60) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812 #3 0x00002b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb512d8 "\017", offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>, IFDlength=13482, displacement=30, section_index=13, ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php- 5.3/ext/exif/exif.c:3135 #4 0x00002b6649be123b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca "\027", value_len=3476, offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>, IFDlength=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813 #5 0x00002b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb5085c "|\222\a", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089 #6 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb507b2 "\037", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=7) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #7 0x00002b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb4ff36 "i\207\004", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126 #8 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb4fec8 "\v", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=3) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #9 0x00002b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4fec0 "II*", length=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240 #10 0x00002b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4feb8 "4²Exif", length=13490, displacement=22) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265 #11 0x00002b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410 #12 0x00002b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792 #13 0x00002b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450, FileName=0x1eb4b8e8 "/tmp/1.orig.jpg", read_thumbnail=0, read_all=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3931 #14 0x00002b6649be4e27 in zif_exif_read_data (ht=1, return_value=0x1eb4aac0, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3984 #15 0x00000000008e7d95 in zend_do_fcall_common_helper_SPEC (execute_data=0x2b664a23b090) at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:320 #16 0x00000000008ed77c in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x2b664a23b090) at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:1640 ---Type <return> to continue, or q <return> to quit--- Previous Comments: ------------------------------------------------------------------------ [2012-07-10 16:11:45] laruence@php.net yeah, please, build with -g, give us more info :), thanks ------------------------------------------------------------------------ [2012-07-10 13:59:20] bigbug at mafia dot lv The file causing crash http://2000.lv/1.orig.jpg ------------------------------------------------------------------------ [2012-07-10 13:55:24] bigbug at mafia dot lv Description: ------------ i got the jpeg file which is crashing our production server when exif_read_data is called. I have testet with latest 5.3 snapshot, same there. Same results for 5.2 version, same results with 32 or 64bit versions. Test script: --------------- <?php exif_read_data("1.orig.jpg"); ?> Expected result: ---------------- return the array of exif data Actual result: -------------- Reading symbols from /usr/bin/php...(no debugging symbols found)...done. [New LWP 27266] warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Core was generated by `php filed.php'. Program terminated with signal 11, Segmentation fault. #0 0x080e5046 in ?? () (gdb) bt #0 0x080e5046 in ?? () #1 0x080e561d in ?? () #2 0x080e60b3 in ?? () #3 0x080e6bbe in ?? () #4 0x080e70ef in ?? () #5 0x080e6e00 in ?? () #6 0x080e70ef in ?? () #7 0x080e906c in ?? () #8 0x080e92c2 in ?? () #9 0x083985ca in ?? () #10 0x0834344e in execute () #11 0x0831c199 in zend_execute_scripts () #12 0x082c2dce in php_execute_script () #13 0x0806b47f in ?? () #14 0x0077c113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6 #15 0x0806b521 in _start () Shoid i build php with debug symbols? ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62523&edit=1