Sec Bug->Bug #73315 [Nab]: Potential memory leak in image2wbmp()

Edit report at https://bugs.php.net/bug.php?id=73315&edit=1 ID: 73315 Updated by: cmb@php.net Reported by: cmb@php.net Summary: Potential memory leak in image2wbmp() Status: Not a bug -Type: Security +Type: Bug Package: GD related Operating System: * PHP Version: 7.0.11 Assigned To: cmb Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2016-10-13 14:57:38] cmb@php.net Actually, _php_image_bw_convert() is unused as of commit cb5c9156[1], so there is no memory leak possible. [1] <http://git.php.net/?p=php-src.git;a=commit;h=cb5c9156c233a260e7a588141863720de82d2926> ------------------------------------------------------------------------ [2016-10-13 14:14:11] cmb@php.net Well, actually im_dest is neither freed on success, so this appears to be a security issue. ------------------------------------------------------------------------ [2016-10-13 14:02:40] cmb@php.net Description: ------------ If gdImageColorAllocate() or gdImageTrueColorToPalette() fails in _php_image_bw_convert()[1] the function returns without destroying im_dest, and as such causing a memory leak. It is not possible to provide a reproduce script, because gdImageColorAllocate() is not supposed to ever fail in this context, and gdImageTrueColorToPalette() would only fail due to out-of-memory conditions which most likely already have been causing a fatal PHP error due to memory_limit. [1] <https://github.com/php/php-src/blob/PHP-7.0.11/ext/gd/gd.c#L3968-L4016> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73315&edit=1