Bug #68713 [Asn->Csd]: infinite loop / infinite free

Edit report at https://bugs.php.net/bug.php?id=68713&edit=1 ID: 68713 Updated by: remi@php.net Reported by: bugreports at internot dot info Summary: infinite loop / infinite free -Status: Assigned +Status: Closed Type: Bug Package: GD related Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2015-01-02 (Git) Assigned To: remi Block user comment: N Private report: N New Comment: Automatic comment on behalf of remi Revision: http://git.php.net/?p=php-src.git;a=commit;h=df4aaa81ef5a65056e09958a5ab62fa8d296bfc1 Log: Fix Bug #68713 infinite loop / infinite free Previous Comments: ------------------------------------------------------------------------ [2015-01-03 05:23:13] bugreports at internot dot info Ok cool. @remi: Do you know of any programs using libgd, where gdMalloc does not call an emalloc-"like" allocator, that just quits on failure? Thanks, ------------------------------------------------------------------------ [2015-01-03 05:15:34] stas@php.net We may want to merge the upstream for cleanness but doesn't look like security issue in PHP. ------------------------------------------------------------------------ [2015-01-03 05:11:56] stas@php.net Why the condition is "yy >= yy - 1"? I imagine for unsigned it's the same as yy != 0 but why not write it this way then? In any case, emalloc in PHP never returns NULL so in PHP context it is kind of an academic exercise. ------------------------------------------------------------------------ [2015-01-02 08:38:50] bugreports at internot dot info So you're saying that clean_on_error can never be called, so it can't get to that code? Why is it there then? Anyways, if clean_on_error was reached and it did get to that code, it will cause either a denial of service, or a crash(or both). the crash may be exploitable due to it calling invalid memory. Perhaps somebody that knows more about the security of PHP(aka. not me) should comment. Thanks, ------------------------------------------------------------------------ [2015-01-02 08:29:46] remi@php.net In PHP gdMalloc is mapped to emalloc which will never return NULL (but bailout with memory limit error), so the "clean_on_error" will never be used. And I haven't say there is no bug, yes the infinite loop exists in libgd (not in PHP), I just say I can't see how this can raise security issue. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=68713 -- Edit this bug report at https://bugs.php.net/bug.php?id=68713&edit=1