Bug #74910 [Asn->Fbk]: getimagesize on SWC files returns zero width and height
Edit report at https://bugs.php.net/bug.php?id=74910&edit=1
ID: 74910
Updated by: cmb@php.net
Reported by: adam dot rosadzinski at home dot net dot pl
Summary: getimagesize on SWC files returns zero width and
height
-Status: Assigned
+Status: Feedback
Type: Bug
Package: GetImageSize related
Operating System: Arch Linux
PHP Version: Irrelevant
Assigned To: cmb
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2017-08-11 09:38:58] cmb@php.net
I have no experience with SWC (or SWF for that matter), but the
code in php_handle_swc() looks fishy. The patch, however, does not
look good either, because it would pass 0 as destLen argument to
uncompress() while destLen is supposed to be the length of the
destination buffer on function entry.
Anyway, I think we need a few small SWC sample files for testing.
Adam, can you provide these?
------------------------------------------------------------------------
[2017-08-11 06:27:32] kalle@php.net
@christoph, since you recently have been fiddling around with the getimagesizes() stuff and gd,
could you verify this?
------------------------------------------------------------------------
[2017-07-12 12:55:42] adam dot rosadzinski at home dot net dot pl
Submitted patch was prepared for PHP 7.0
------------------------------------------------------------------------
[2017-07-12 12:16:59] adam dot rosadzinski at home dot net dot pl
Description:
------------
Since zlib 1.2.9 has been released, changes in uncompress function exposed problem in php_handle_swc
function from ext/standard/image.c
Before 1.2.9, uncompress didn't touch destBytes value on failure. As of 1.2.9 it will be set to
0.
No data will be copied if first uncompress call fails, as len value will be changed to 0 and then
used to copy uncompressed data from temporary buffer.
Verified on PHP: 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74910&edit=1
Thread (6 messages)