Bug #62523 [Asn]: php crashes with segfault when exif_read_data called

Edit report at https://bugs.php.net/bug.php?id=62523&edit=1 ID: 62523 Updated by: stas@php.net Reported by: bigbug at mafia dot lv Summary: php crashes with segfault when exif_read_data called Status: Assigned Type: Bug Package: Reproducible crash Operating System: linux PHP Version: 5.6.23 Assigned To: stas Block user comment: N Private report: N New Comment: I'm not sure what this has to do with openssl (given that the URL is not HTTPS). But I'll check what happens with these images. Previous Comments: ------------------------------------------------------------------------ [2016-07-31 11:56:30] cmb@php.net <?php exif_read_data('http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg'); Indeed, valgrind reports | Conditional jump or move depends on uninitialised value(s) In this case cert_captured is uninitialized in the check whether peer_cert has to be freed[1]. After adding a proper initializer, there are still memory leaks reported by valgrind (also when file_get_contents() is used instead of exif_read_data() with the unmodified C code). Stas, could you have a look at this issue? [1] <https://github.com/php/php-src/blob/PHP-7.0.9/ext/openssl/xp_ssl.c#L1893> ------------------------------------------------------------------------ [2016-07-31 04:22:24] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2016-07-18 14:17:44] dessander at gmail dot com $ uname -a Linux grevus 4.6.4-1-ARCH #1 SMP PREEMPT Mon Jul 11 19:12:32 CEST 2016 x86_64 GNU/Linux $ php -v PHP 7.0.8 (cli) (built: Jun 22 2016 16:45:35) ( NTS ) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies $ cat test.php && echo "" && php test.php <?php exif_read_data('http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg'); Segmentation fault (core dumped) ------------------------------------------------------------------------ [2016-07-18 13:50:47] cmb@php.net I've tested with <http://www.getid3.org/temp/62523.jpg>, and that segfaulted with php-5.5.7-nts-Win32-VC11-x86 and earlier, but not as of php-5.5.8-nts-Win32-VC11-x86. That lead me to a commit which added tests for this bug[1]. This commit shortly follows the merge of PR #293[2], where it is claimed that the PR is unrelated to this bug. :? <http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg> however, has been reported to segfault with 5.6.15, but I can't reproduce that (neither on Windows nor on Linux); instead I get the warning "Unable to open file" (which doesn't happen for the other image). So perhaps we're dealing with two bugs here. [1] <https://github.com/php/php-src/commit/2fa5f39> ------------------------------------------------------------------------ [2016-07-17 23:21:36] stas@php.net Derick, is this still an issue? If so, could yu please provide the faulty image? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62523 -- Edit this bug report at https://bugs.php.net/bug.php?id=62523&edit=1