Sec Bug->Bug #73911 [Ver->Csd]: Missing null byte checks for paths in exif_imagetype

Edit report at https://bugs.php.net/bug.php?id=73911&edit=1 ID: 73911 Updated by: stas@php.net Reported by: max at cert dot cx Summary: Missing null byte checks for paths in exif_imagetype -Status: Verified +Status: Closed -Type: Security +Type: Bug Package: EXIF related Operating System: * PHP Version: 5.6.29 -Assigned To: +Assigned To: stas Block user comment: N Private report: Y New Comment: The fix for this bug has been committed. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2017-01-12 01:30:32] cmb@php.net The following patch has been added/updated: Patch Name: fix-73911 Revision: 1484184632 URL: https://bugs.php.net/patch-display.php?bug=73911&patch=fix-73911&revision=1484184632 ------------------------------------------------------------------------ [2017-01-10 20:36:19] max at cert dot cx Description: ------------ exif_imagetype doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the file path. =============================================== Affected code: PHP_FUNCTION(exif_imagetype) { char *imagefile; size_t imagefile_len; php_stream * stream; int itype = 0; if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &imagefile, &imagefile_len) == FAILURE) { ⇐== THIS LINE return; } =============================================== Test script: --------------- <?php var_dump(exif_imagetype("./image.png\x00.gallery.jpg")); ?> Expected result: ---------------- expected parameter instead of string Actual result: -------------- $ php curl.php int(3) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73911&edit=1