Bug #70976 [ReO->Csd]: Memory Read via gdImageRotateInterpolated Array Index Out of Bounds

Edit report at https://bugs.php.net/bug.php?id=70976&edit=1 ID: 70976 Updated by: jpauli@php.net Reported by: emmanuel dot law at gmail dot com Summary: Memory Read via gdImageRotateInterpolated Array Index Out of Bounds -Status: Re-Opened +Status: Closed Type: Bug Package: GD related Operating System: * PHP Version: 5.6.15 Assigned To: jpauli Block user comment: N Private report: N CVE-ID: CVEE-2016-1903 New Comment: The fix for this bug has been committed. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. BC fixed in 5.5.32 and up Previous Comments: ------------------------------------------------------------------------ [2016-01-14 15:14:58] pajoye@php.net The patch is wrong and is a BC break. That will basically break for any true color image with a background color value > 256. gdMaxColors constant should never be used for truecolor images. The test that should have modified is the one here: https://github.com/php/php-src/blob/4bb422343f29f06b7081323844d9b52e1a71e4a5/ext/gd/libgd/gd_interpolation.c#L2165 See my last comment here. I supposed it is already released right? ------------------------------------------------------------------------ [2016-01-12 13:07:57] remi@php.net In 5.5.31/5.6.17/7.0.2 https://github.com/php/php-src/commit/4bb422343f29f06b7081323844d9b52e1a71e4a5 https://github.com/php/php-src/commit/2baeb167a08b0186a885208bdc8b5871f1681dc8 In next https://github.com/php/php-src/commit/aa8d3a8cc612ba87c0497275f58a2317a90fb1c4 ------------------------------------------------------------------------ [2016-01-06 06:35:06] ab@php.net Automatic comment on behalf of stas Revision: http://git.php.net/?p=php-src.git;a=commit;h=4b8394dd78571826ac66a69dc240c623f31d78f8 Log: Fix bug #70976: fix boundary check on gdImageRotateInterpolated ------------------------------------------------------------------------ [2016-01-06 06:34:41] ab@php.net Automatic comment on behalf of stas Revision: http://git.php.net/?p=php-src.git;a=commit;h=4bb422343f29f06b7081323844d9b52e1a71e4a5 Log: Fix bug #70976: fix boundary check on gdImageRotateInterpolated ------------------------------------------------------------------------ [2016-01-06 06:34:34] ab@php.net Automatic comment on behalf of stas Revision: http://git.php.net/?p=php-src.git;a=commit;h=84b8db597ae597abce1977ce64dcf231e71330f9 Log: Fix bug #70976: fix boundary check on gdImageRotateInterpolated ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70976 -- Edit this bug report at https://bugs.php.net/bug.php?id=70976&edit=1