Bug #68717 [NEW]: use after free

From: bugreports at internot dot info Operating system: Linux Ubuntu 14.04 PHP version: master-Git-2015-01-02 (Git) Package: GD related Bug Type: Bug Bug description:use after free Description: ------------ Hi, In /ext/gd/libgd/gd_io_dp.c: if this goes to the false branch: 333 if ((newPtr = gdRealloc(dp->data, required))) { 334 dp->realSize = required; 335 dp->data = newPtr; 336 return TRUE; 337 } the fact there is code after this, makes me think it is possible for this to happen: 'dp->data' will be freed but not re-allocated. It is then used here: 343 memcpy(newPtr, dp->data, dp->logicalSize); which will cause a use-after-free bug. Thanks, -- Edit bug report at https://bugs.php.net/bug.php?id=68717&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68717&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68717&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68717&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68717&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68717&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68717&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68717&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68717&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68717&r=support Expected behavior: https://bugs.php.net/fix.php?id=68717&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68717&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68717&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68717&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68717&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68717&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68717&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68717&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68717&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68717&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68717&r=mysqlcfg