Bug #62523 [Csd]: php crashes with segfault when exif_read_data called

Edit report at https://bugs.php.net/bug.php?id=62523&edit=1 ID: 62523 Updated by: kalle@php.net Reported by: romans dot heimanis at gmail dot com Summary: php crashes with segfault when exif_read_data called Status: Closed Type: Bug Package: Reproducible crash Operating System: linux PHP Version: 5.6.23 -Assigned To: stas +Assigned To: kalle Block user comment: N Private report: N New Comment: The fix for this bug has been committed. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2017-07-07 10:20:27] kalle@php.net Automatic comment on behalf of kalle Revision: http://git.php.net/?p=php-src.git;a=commit;h=e6903d471e45177c248adfb4f1abdfdd5487d7bf Log: * Fixed bug #72819 (EXIF thumbnails not read anymore) * Fixed bug #62523 (php crashes with segfault when exif_read_data called) * Fixed the poor test case for #62523, which was a HTML document ------------------------------------------------------------------------ [2016-08-01 17:24:32] stas@php.net If exif it fine with the file data, then this is another bug for sure. Let's open a new issue and add specific info regarding the backtraces, valgrind output and such. ------------------------------------------------------------------------ [2016-08-01 09:49:36] cmb@php.net > I'm not sure what this has to do with openssl (given that the > URL is not HTTPS). $ curl -I -s http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg' | grep location location: http://dl.dropboxusercontent.com/u/7562584/Bugs/Php/bad_exif.jpeg > Sorry, unable to reproduce any issues on either 5.6 or 7.0 with > either bad_exif.jpeg or 62523.jpg. Reading the exif data from a local file shows no issues; the problem is with the connection to the server. I've tested and debugged with the 5.6 branch, but I assume the issue occurs also with newer versions (PHP 7.0.8 on Windows gave a segfault). Did you try stepping through php_openssl_enable_crypto[1]? In my tests with exif_read_data(), cert_captured never got assigned (because stream->context was NULL), but it was tested on line 1791[2]. When I used file_get_contents() instead of exif_read_data() in the reproduce script, stream->context was set, so cert_captured is properly initialized, but still valgrind reported memory leaks. [1] <https://github.com/php/php-src/blob/PHP-5.6.24/ext/openssl/xp_ssl.c#L1669> [2] <https://github.com/php/php-src/blob/PHP-5.6.24/ext/openssl/xp_ssl.c#L1791> ------------------------------------------------------------------------ [2016-08-01 08:41:30] romans dot heimanis at gmail dot com Just changing original e-mail ------------------------------------------------------------------------ [2016-08-01 06:18:52] stas@php.net Sorry, unable to reproduce any issues on either 5.6 or 7.0 with either bad_exif.jpeg or 62523.jpg. No segfaults, not complaints, nothing. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62523 -- Edit this bug report at https://bugs.php.net/bug.php?id=62523&edit=1