Bug #70052 [NEW]: getimagesize() + WBMP integer overflow

From: p at wspnr dot com Operating system: Debian Linux PHP version: master-Git-2015-07-12 (Git) Package: GetImageSize related Bug Type: Bug Bug description:getimagesize() + WBMP integer overflow Description: ------------ 1. getimagesize() seems to artificially limit the size of valid WBMPs to 2048x2048, even though imagecreatefromwbmp() will happily load WBMPs of arbitrary dimensions. 2. There is an integer overflow bug that occurs when the size of the supplied WBMP, as indicated in the header, is greater than (2^31-1) resulting in invalid WBMPs returning a "valid" response. This may cause problems for scripts that use getimagesize() to detect whether a file is an image or not. Test script: --------------- -- WBMP 1, 2047x2047 -- 00 00 80 80 80 8F 7F 80 80 80 8F 7F -- WBMP 2, 2048x2048 -- 00 00 80 80 80 90 00 80 80 80 90 00 -- WBMP 3, 2049x2049 -- 00 00 80 80 80 90 01 80 80 80 90 01 -- WBMP 4, (2^31)x(2^31) -- 00 00 88 80 80 80 00 88 80 80 80 00 -- WBMP 5, (2^32-1)x(2^32-1) -- 00 00 8F FF FF FF 7F 8F FF FF FF 7F -- PHP -- <?php for($i = 1; $i <= 5); ++$i) { echo "WBMP ", $i, PHP_EOL; var_dump(getimagesize("wbmp" . $i . ".wbmp")); } Expected result: ---------------- WBMP 1 array(5) { [0]=> int(2047) [1]=> int(2047) [2]=> int(15) [3]=> string(26) "width="2047" height="2047"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } WBMP 2 array(5) { [0]=> int(2048) [1]=> int(2048) [2]=> int(15) [3]=> string(26) "width="2048" height="2048"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } WBMP 3 bool(false) WBMP 4 bool(false) WBMP 5 bool(false) Actual result: -------------- WBMP 1 array(5) { [0]=> int(2047) [1]=> int(2047) [2]=> int(15) [3]=> string(26) "width="2047" height="2047"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } WBMP 2 array(5) { [0]=> int(2048) [1]=> int(2048) [2]=> int(15) [3]=> string(26) "width="2048" height="2048"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } WBMP 3 bool(false) WBMP 4 array(5) { [0]=> int(2147483648) [1]=> int(2147483648) [2]=> int(15) [3]=> string(40) "width="-2147483648" height="-2147483648"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } WBMP 5 array(5) { [0]=> int(4294967295) [1]=> int(4294967295) [2]=> int(15) [3]=> string(22) "width="-1" height="-1"" ["mime"]=> string(18) "image/vnd.wap.wbmp" } -- Edit bug report at https://bugs.php.net/bug.php?id=70052&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70052&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70052&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70052&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70052&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70052&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70052&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70052&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70052&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70052&r=support Expected behavior: https://bugs.php.net/fix.php?id=70052&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70052&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70052&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70052&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70052&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70052&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70052&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70052&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70052&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70052&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70052&r=mysqlcfg