Sec Bug->Bug #75076 [Csd->Nab]: bug #74435 has not been fixed

Edit report at https://bugs.php.net/bug.php?id=75076&edit=1 ID: 75076 Updated by: cmb@php.net Reported by: varsleak at gmail dot com Summary: bug #74435 has not been fixed -Status: Closed +Status: Not a bug -Type: Security +Type: Bug Package: GD related Operating System: Ubuntu 16.40 x64 PHP Version: 7.1.8 Assigned To: cmb Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2017-08-24 06:16:36] varsleak at gmail dot com Not a issus. ------------------------------------------------------------------------ [2017-08-16 17:23:35] cmb@php.net The fact that the test case fails for this image is irrelevant. Please provide a simple test script, and clear information on what you expect the script to do, and what it actually does. Please also note, that libgd is not supposed to import animated GIFs. It only reads the first image of the GIF file. ------------------------------------------------------------------------ [2017-08-15 03:35:43] varsleak at gmail dot com Description: ------------ I tested bug #74435, it has not been fixed, the details are as follows: replease ext/gd/tests/bug74435.gif with https://github.com/varsleak/varsleak-vul/blob/master/php-src-vul/issus_75076/issus75076.gif and run make test|grep bug74435 results is a failure. ➜ php-src.orig git:(PHP-7.1.8) ✗ make test|grep bug74435 FAIL Bug #74435 (Buffer over-read into uninitialized memory) [ext/gd/tests/bug74435.phpt] Test script: --------------- same as https://bugs.php.net/bug.php?id=74435 Expected result: ---------------- PASS Bug #74435 (Buffer over-read into uninitialized memory) [ext/gd/tests/bug74435.phpt] Actual result: -------------- FAIL Bug #74435 (Buffer over-read into uninitialized memory) [ext/gd/tests/bug74435.phpt] ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75076&edit=1