Bug #66147 [NEW]: exif_read_data causes segmentation fault on some JPEG files with EXIF
From: stephon at gmail dot com
Operating system: FreeBSD 9.2-Release
PHP version: 5.4.22
Package: mbstring related
Bug Type: Bug
Bug description:exif_read_data causes segmentation fault on some JPEG files with EXIF
Description:
------------
Hello all,
We have found that some kind of JPEG files using exif_read_data causes
segmentation fault, like the image below:
http://people.cs.nctu.edu.tw/~chenbc/php-mbstring-coredump.jpg
Our test environment has PHP exif and mbstring extensions enabled.
When only exif extension enabled, the scripts works fine.
but it cause segmentation fault while both exif and mbstring extension
enabled.
Here are GDB trace results:
> gdb /usr/local/bin/php
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "amd64-marcel-freebsd"...(no debugging
symbols found)...
(gdb) run test2.php
Starting program: /usr/local/bin/php test2.php
(no debugging symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...[New LWP 100417]
(no debugging symbols found)...(no debugging symbols found)...[New
Thread 1002407400 (LWP 100417/php)]
(no debugging symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1002407400 (LWP 100417/php)]
0x0000001003276b9d in mbfl_buffer_converter_new2 () from
/usr/local/lib/php/20100525/mbstring.so
But in our environment, mbstring is needed for other programs use.
Is there any way to keep both exif and mbstring enabled, or how to skip
errors while exif_read_data causes problems?
Thanks a lot
Test script:
---------------
#!/usr/local/bin/php
<?php
$file = 'php-mbstring-coredump.jpg';
$array = exif_read_data($file);
print_r($array);
exit;
Expected result:
----------------
Array
(
[FileName] => test2.jpg
[FileDateTime] => 1385117776
[FileSize] => 23155
[FileType] => 2
[MimeType] => image/jpeg
[SectionsFound] => ANY_TAG, IFD0, EXIF, INTEROP
[COMPUTED] => Array
(
[html] => width="240" height="320"
[Height] => 320
[Width] => 240
[IsColor] => 1
[ByteOrderMotorola] => 1
[ExposureTime] => 0.500 s (1/2)
[Copyright] => stephonhaha
)
[ImageDescription] => 20090918164650
[Make] => DoCoMo
[Model] => L704i
[Orientation] => 1
[XResolution] => 72/1
[YResolution] => 72/1
[ResolutionUnit] => 2
[DateTime] => 2009:09:18 17:36:57
[YCbCrPositioning] => 1
[Copyright] => stephonhaha
[Exif_IFD_Pointer] => 224
[ExifVersion] => 0220
[DateTimeOriginal] => 2009:09:18 16:48:42
[DateTimeDigitized] => 2009:09:18 17:36:57
[ComponentsConfiguration] =>
[ShutterSpeedValue] => 1/1
[Flash] => 1
[FocalLength] => 1/1
[MakerNote] =>
[UserComment] => JISP2009_0918_164842
[FlashPixVersion] => 0100
[ColorSpace] => 1
[ExifImageWidth] => 240
[ExifImageLength] => 320
[InteroperabilityOffset] => 498
[InterOperabilityIndex] => R98
[InterOperabilityVersion] => 0100
)
Actual result:
--------------
Segmentation fault
--
Edit bug report at https://bugs.php.net/bug.php?id=66147&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66147&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66147&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66147&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=66147&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=66147&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=66147&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=66147&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=66147&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=66147&r=support
Expected behavior: https://bugs.php.net/fix.php?id=66147&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=66147&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=66147&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=66147&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66147&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=66147&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=66147&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=66147&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=66147&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=66147&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=66147&r=mysqlcfg
Thread (5 messages)
- stephon at gmail dot com