#19197 [Opn]: Serious bug with ImageCreateTrueColor and/or ? file upload

ID: 19197 User updated by: bugsphp@yayel.com Reported By: bugsphp@yayel.com Status: Open Bug Type: GD related Operating System: Linux Redhat 7.2 PHP Version: 4.2.2 New Comment: Apache reports several times in error_log strings like that one: [Fri Aug 30 17:00:17 2002] [notice] child pid 29648 exit signal Segmentation fault (11) Previous Comments: ------------------------------------------------------------------------ [2002-08-30 11:05:19] bugsphp@yayel.com Sorry Cynic, I don't really have a debugging experience. I did not know what to cut (that's why code is not published here), but know that everything gets ok if ImageCreateTrueColor() (line 91) is replaced by ImageCreate(). I'll rebuild php, please tell me how to find the backtrace. ------------------------------------------------------------------------ [2002-08-30 11:01:07] bugsphp@yayel.com Oh, one last thing: I talked about a bug which may be turn into a security problem because the *entire* script seems to loop, and because it *crashes* at the end: there is no html output (IE stops, Mozilla alerts "this document contains no data"). ------------------------------------------------------------------------ [2002-08-30 11:00:01] cynic@php.net you'll need to cut it down to only the offending code if you want someone look at it. the good people who work on php have better things to do than wade through other people's code, and even more so as 95% of it turns out to be pilot error. i know this sounds harsh, but try to look at it from the opposite side. now to your problem. the script running 20 times looks like dying httpd processes, but that'd be obvious from the apache logs. if this is the case, rebuild php with --enable-debug, and post a backtrace. ------------------------------------------------------------------------ [2002-08-30 10:51:35] bugsphp@yayel.com I decided to publish my code: http://yayel.com/bug/users_postpicture.php.txt ------------------------------------------------------------------------ [2002-08-30 10:42:10] bugsphp@yayel.com Hi Having a script in charge of resampling uploaded pictures. This following bug only affects Gif image with ImageCreateTrueColor() function. Note that things go ok with ImageCreate() function, and with jpeg/png files and ImageCreateTrueColor() function. The script takes and checks a fresh uploaded picture, merges it with my logo, resizes it with ImageCopyResampled and saves both original and thumbnails with the apropriate function (ImageGif, ImageJpg, ImagePng), insert properties in mysql db and cleans e/t at the end. I did use ImageCreate() for creating my thumbnails, and colors were bad until I used ImageCreateTrueColor() BUT if I uploaded an image with $_FILES["file"]["type"] == 'image/gif', things go weird as the script tries 20 times to saves the files and insert into mysql (and there is no loop coded at all!!!) According to Apache log, my http client calls only one time the script. This is really bizarre and I do worry about it, since it may be a security problem... Using gd2.0.1 from http://www.rime.com.au/gd/, php4.2.2 with Apache 1.3.26 : './configure' '--with-apache=../apache_1.3.26' '--enable-trans-sid' '--with-jpeg-dir' '--with-gd=../gd-2.0.1' '--with-tiff-dir' '--with-png-dir' '--with-zlib-dir' '--with-pdflib' '--enable-ftp' '--enable-gd-native-ttf' '--with-freetype-dir=/usr/include/freetype2' '--with-mysql=/usr/local/mysql' '--with-gettext' '--with-pgsql=/usr' '--with-imap' '--with-kerberos' '--enable-sysvsem' '--enable-sysvshm' '--with-xml' '--with-db' '--enable-bcmath' '--enable-calendar' '--with-imap-ssl' Tell me if you want more details or code exemples. Thank you. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=19197&edit=1